Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:2392-1

Опубликовано: 19 июл. 2021
Источник: suse-cvrf

Описание

Security update for go1.16

This update for go1.16 fixes the following issues:

go1.16.6 (released 2021-07-12, bsc#1182345) includes a security fix to the crypto/tls package, as well as bug fixes to the compiler, and the net and net/http packages.

Security issue fixed:

CVE-2021-34558: Fixed crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters (bsc#1188229)

go1.16 release:

  • bsc#1188229 go#47143 CVE-2021-34558
  • go#47145 security: fix CVE-2021-34558
  • go#46999 net: LookupMX behaviour broken
  • go#46981 net: TestCVE202133195 fails if /etc/resolv.conf specifies ndots larger than 3
  • go#46769 syscall: TestGroupCleanupUserNamespace test failure on Fedora
  • go#46657 runtime: deeply nested struct initialized with non-zero values
  • go#44984 net/http: server not setting Content-Length in certain cases

Список пакетов

openSUSE Leap 15.3
go1.16-1.16.6-1.20.1
go1.16-doc-1.16.6-1.20.1
go1.16-race-1.16.6-1.20.1

Ссылки

Описание

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

Затронутые продукты
openSUSE Leap 15.3:go1.16-1.16.6-1.20.1
openSUSE Leap 15.3:go1.16-doc-1.16.6-1.20.1
openSUSE Leap 15.3:go1.16-race-1.16.6-1.20.1
Ссылки