RLSA-2022:1819

See a problem?
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2022:1819.json
JSON Data
https://api.osv.dev/v1/vulns/RLSA-2022:1819
Related
Published
2022-05-10T06:29:31Z
Modified
2023-02-02T14:12:55.752707Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Moderate: go-toolset:rhel8 security and bug fix update
Details

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • golang: Command-line arguments may overwrite global data (CVE-2021-38297)

  • golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)

  • golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)

  • golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

  • golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)

  • golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

  • golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:8 / delve

Package

Name
delve
Purl
pkg:rpm/rocky-linux/delve?distro=rocky-linux-8-6-legacy&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:1.7.2-1.module+el8.6.0+824+8e984c20

Rocky Linux:8 / golang

Package

Name
golang
Purl
pkg:rpm/rocky-linux/golang?distro=rocky-linux-8-6-legacy&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:1.17.7-1.module+el8.6.0+824+8e984c20

Rocky Linux:8 / go-toolset

Package

Name
go-toolset
Purl
pkg:rpm/rocky-linux/go-toolset?distro=rocky-linux-8-6-legacy&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:1.17.7-1.module+el8.6.0+824+8e984c20