Issued:

2024-04-30

Updated:

2024-04-30

RHSA-2024:2562 - Important: golang security update

Synopsis

Important: golang security update

Type/Severity

Security Advisory Important

Topic

An update for golang is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)

• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)

• golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• golang-1.21.9-2.el9_4.src.rpm
• golang-src-1.21.9-2.el9_4.noarch.rpm
• golang-1.21.9-2.el9_4.x86_64.rpm
• golang-1.21.9-2.el9_4.ppc64le.rpm
• go-toolset-1.21.9-2.el9_4.x86_64.rpm
• golang-docs-1.21.9-2.el9_4.noarch.rpm
• golang-bin-1.21.9-2.el9_4.s390x.rpm
• golang-1.21.9-2.el9_4.s390x.rpm
• golang-bin-1.21.9-2.el9_4.ppc64le.rpm
• golang-misc-1.21.9-2.el9_4.noarch.rpm
• golang-1.21.9-2.el9_4.aarch64.rpm
• golang-bin-1.21.9-2.el9_4.x86_64.rpm
• golang-tests-1.21.9-2.el9_4.noarch.rpm
• go-toolset-1.21.9-2.el9_4.s390x.rpm
• golang-bin-1.21.9-2.el9_4.aarch64.rpm
• go-toolset-1.21.9-2.el9_4.aarch64.rpm
• go-toolset-1.21.9-2.el9_4.ppc64le.rpm

Fixes

• This content is not included.BZ - 2262921
• This content is not included.BZ - 2268017
• This content is not included.BZ - 2268018
• This content is not included.BZ - 2268019
• This content is not included.BZ - 2268021
• This content is not included.BZ - 2268022
• This content is not included.BZ - 2268273

CVEs

• CVE-2023-45288
• CVE-2023-45289
• CVE-2023-45290
• CVE-2024-1394
• CVE-2024-24783
• CVE-2024-24784
• CVE-2024-24785

References

• https://access.redhat.com/security/updates/classification/#important

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.