Описание
Security update for go1.21-openssl
This update for go1.21-openssl fixes the following issues:
-
CVE-2024-34158: Fixed stack exhaustion in Parse in go/build/constraint (bsc#1230254).
-
CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode in encoding/gob (bsc#1230253).
-
CVE-2024-34155: Fixed stack exhaustion in all Parse* functions (bsc#1230252).
-
Update to version 1.21.13.3 cut from the go1.21-fips-release (jsc#SLE-18320).
Список пакетов
SUSE Linux Enterprise Module for Development Tools 15 SP5
openSUSE Leap 15.5
Ссылки
- Link for SUSE-SU-2024:3809-1
- E-Mail link for SUSE-SU-2024:3809-1
- SUSE Security Ratings
- SUSE Bug 1230252
- SUSE Bug 1230253
- SUSE Bug 1230254
- SUSE CVE CVE-2024-34155 page
- SUSE CVE CVE-2024-34156 page
- SUSE CVE CVE-2024-34158 page
Описание
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
Затронутые продукты
Ссылки
- CVE-2024-34155
- SUSE Bug 1230252
Описание
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Затронутые продукты
Ссылки
- CVE-2024-34156
- SUSE Bug 1230253
Описание
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
Затронутые продукты
Ссылки
- CVE-2024-34158
- SUSE Bug 1230254