You are here
Home > Preporuke > Sigurnosni nedostatak programskog paketa go1.14

Sigurnosni nedostatak programskog paketa go1.14

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LSU

openSUSE Security Update: Security update for go1.14
______________________________________________________________________________

Announcement ID: openSUSE-SU-2020:1587-1
Rating: moderate
References: #1164903 #1176031
Cross-References: CVE-2020-24553
Affected Products:
openSUSE Leap 15.2
______________________________________________________________________________

An update that solves one vulnerability and has one errata
is now available.

Description:

This update for go1.14 fixes the following issues:

– go1.14.9 (released 2020-09-09) includes fixes to the compiler, linker,
runtime, documentation, and the net/http and testing packages. Refs
bsc#1164903 go1.14 release tracking
* go#41192 net/http/fcgi: race detected during execution of
TestResponseWriterSniffsContentType test
* go#41016 net/http: Transport.CancelRequest no longer cancels in-flight
request
* go#40973 net/http: RoundTrip unexpectedly changes Request
* go#40968 runtime: checkptr incorrectly -race flagging when using &^
arithmetic
* go#40938 cmd/compile: R12 can be clobbered for write barrier call on
PPC64
* go#40848 testing: “=== PAUSE” lines do not change the test name for
the next log line
* go#40797 cmd/compile: inline marker targets not reachable after
assembly on arm
* go#40766 cmd/compile: inline marker targets not reachable after
assembly on ppc64x
* go#40501 cmd/compile: for range loop reading past slice end
* go#40411 runtime: Windows service lifecycle events behave incorrectly
when called within a golang environment
* go#40398 runtime: fatal error: checkdead: runnable g
* go#40192 runtime: pageAlloc.searchAddr may point to unmapped memory in
discontiguous heaps, violating its invariant
* go#39955 cmd/link: incorrect GC bitmap when global’s type is in
another shared object
* go#39690 cmd/compile: s390x floating point <-> integer conversions
clobbering the condition code
* go#39279 net/http: Re-connect with upgraded HTTP2 connection fails to
send Request.body
* go#38904 doc: include fix for #34437 in Go 1.14 release notes

– go1.14.8 (released 2020-09-01) includes security fixes to the
net/http/cgi and net/http/fcgi packages. CVE-2020-24553 Refs bsc#1164903
go1.14 release tracking
* bsc#1176031 CVE-2020-24553
* go#41164 net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when
Content-Type is not specified This update was imported from the
SUSE:SLE-15:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 15.2:

zypper in -t patch openSUSE-2020-1587=1

Package List:

– openSUSE Leap 15.2 (x86_64):

go1.14-1.14.9-lp152.2.6.1
go1.14-doc-1.14.9-lp152.2.6.1
go1.14-race-1.14.9-lp152.2.6.1

References:

https://www.suse.com/security/cve/CVE-2020-24553.html
https://bugzilla.suse.com/1164903
https://bugzilla.suse.com/1176031


To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

AutorBruno Varga
Cert idNCERT-REF-2020-10-0001-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
IzvorAdobe
Top
More in Preporuke
Sigurnosni nedostaci jezgre operacijskog sustava

Otkriveni su sigurnosni nedostaci jezgre operacijskog sustava openSUSE. Otkriveni nedostaci potencijalnim napadačima omogućuju izazivanje DoS stanja, izvršavanje proizvoljnog programskog koda,...

Close