golang-1.19.10-1.el9, go-toolset-1.19.10-1.el9

エラータID: AXSA:2023-6174:04

Release date: 
Friday, June 30, 2023 - 02:12
Subject: 
golang-1.19.10-1.el9, go-toolset-1.19.10-1.el9
Affected Channels: 
MIRACLE LINUX 9 for x86_64
Severity: 
High
Description: 

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402)
* golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404)
* golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405)
* golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2023-29402
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
CVE-2023-29403
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
CVE-2023-29404
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
CVE-2023-29405
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. golang-1.19.10-1.el9.src.rpm
    MD5: 540f3ac3909fd6378e52e3c772695908
    SHA-256: 53d05dd472be672488ba1e2065004bc65e8f4089c14e18aba406d756996ab65f
    Size: 25.08 MB
  2. go-toolset-1.19.10-1.el9.src.rpm
    MD5: 76760fef4045898c643f335200caa092
    SHA-256: 665e162066873414bd7d0249b018dfae3eac50b43d2881400453bbf37af4a3e9
    Size: 9.96 kB

Asianux Server 9 for x86_64
  1. golang-1.19.10-1.el9.x86_64.rpm
    MD5: 0c1e1edf138c38557cacd434bf569488
    SHA-256: 7abcbde6efef939d2c258f1587a562e52e9944aa84b54ab459894f30f996b7fa
    Size: 574.62 kB
  2. golang-bin-1.19.10-1.el9.x86_64.rpm
    MD5: 7bb706781e2536a159675d57255e0953
    SHA-256: b33777b9acb3a1a198099fd504c9882ea6e45b5a3533a4609427c62c073cb942
    Size: 98.42 MB
  3. golang-docs-1.19.10-1.el9.noarch.rpm
    MD5: 1aa33c711d4ef8f3ccd11ab19d09c455
    SHA-256: 64a231ba354be7a1fda00afbab59756514233201aed8a0250b2bc5c0e70f1820
    Size: 89.91 kB
  4. golang-misc-1.19.10-1.el9.noarch.rpm
    MD5: b5b3d90ed543bbce3eccc154a4b80003
    SHA-256: 6c232b7b1e1f334219aa6b72fc95f47dbbadfebb69cb4de56329be9ab36862aa
    Size: 209.61 kB
  5. golang-race-1.19.10-1.el9.x86_64.rpm
    MD5: ec04dec58ad6ea6eb133abba56e51d4b
    SHA-256: ae41f5b3716088271fba5f11ca949c1010009e5a70fb00f36ca8e5acfac94da3
    Size: 20.29 MB
  6. golang-src-1.19.10-1.el9.noarch.rpm
    MD5: 21285d28827d6b0f9cd9a32ae2987b2d
    SHA-256: 856e2eeb940b066b7cddee600d4c0cc8b53e26a93166761456e3178a3cf45b79
    Size: 11.33 MB
  7. golang-tests-1.19.10-1.el9.noarch.rpm
    MD5: a68610687bb3a988163473e2e9772453
    SHA-256: a438f7e6c357e6db661f1cf002fd0a6d700b84baf0b9a1dc2baaa0ef4b631c6a
    Size: 7.69 MB
  8. go-toolset-1.19.10-1.el9.x86_64.rpm
    MD5: b2343e2e22c569926f870bb9ae7f4fa2
    SHA-256: 561162352d19fd26eeae1fd7caea73953952c6d0a4cca75678b583d10bcc8e8a
    Size: 7.94 kB