go-toolset:rhel8 security update
エラータID: AXSA:2026-564:01
リリース日:
2026/05/08 Friday - 14:40
題名:
go-toolset:rhel8 security update
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Golang の cgo コンパイラには、"cgo" の文字列を含む名前の SWIG
ファイルを暗黙的に信頼してしまう問題があるため、リモートの攻撃者
により、コードスマグリングや任意のコードの実行を可能とする脆弱性
が存在します。(CVE-2026-27140)
- Golang のコンパイラには、ループ内の誘導変数を利用した計算に
おけるアンダーフローやオーバーフローのチェック処理に問題があるため、
リモートの攻撃者により、メモリ破壊を可能とする脆弱性が存在します。
(CVE-2026-27143)
- Golang のコンパイラには、メモリの移動処理における範囲重複の
判定が正しく行われない問題があるため、リモートの攻撃者により、
メモリ破壊を可能とする脆弱性が存在します。(CVE-2026-27144)
- Golang の crypto/x509 ライブラリおよび crypto/tls ライブラリ
には、証明書チェーンの構築処理においてリソースの制限を実施して
いない問題があるため、リモートの攻撃者により、サービス拒否攻撃
(リソース枯渇) を可能とする脆弱性が存在します。(CVE-2026-32280)
- Golang の os パッケージの Root.Chmod() 関数には、シンボリック
リンク先のファイルに対して操作を実施してしまう問題があるため、
ローカルの攻撃者により、ファイルシステム上における許可されていない
パーミッション変更を可能とする脆弱性が存在します。
(CVE-2026-32282)
- Golang の crypto/tls パッケージには、TLS 1.3 のハンドシェイク後
の処理においてデッドロックに至る問題があるため、リモートの攻撃者
により、サービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-32283)
Modularity name: go-toolset
Stream name: rhel8
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-27140
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
CVE-2026-27143
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
CVE-2026-27144
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
CVE-2026-32280
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
CVE-2026-32282
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
CVE-2026-32283
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
追加情報:
N/A
ダウンロード:
SRPMS
- delve-1.25.2-1.module+el8+1978+d9f3c3cc.ML.1.src.rpm
MD5: 1f211ed14aae9a4b65cf86699019c855
SHA-256: 407ec9c7cedd5001d7501406dc57f742faf67ded49a7ce854422620e051da62b
Size: 9.29 MB - golang-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.src.rpm
MD5: 2cc3140d9b3d3b314452281176fd0c08
SHA-256: 3de4531c380b0d31d23fae85aa33ad5e53c693a9df65f99ce9a63c131b463534
Size: 32.78 MB
Asianux Server 8 for x86_64
- delve-1.25.2-1.module+el8+1978+d9f3c3cc.ML.1.x86_64.rpm
MD5: 21f8f0bd81ffaf7aed592636446d7a72
SHA-256: 702d9d38fa4a1f1086b0d538a9e40bbb579e874fbd2ef0f2d6be08d166de9394
Size: 5.55 MB - delve-debugsource-1.25.2-1.module+el8+1978+d9f3c3cc.ML.1.x86_64.rpm
MD5: e7243030eef304a9ede16e82db1202ce
SHA-256: 2b791dd0328416147eb9cd525c8d0772f9cd3eabcd329967aae4fff36618b280
Size: 1.27 MB - golang-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.x86_64.rpm
MD5: 20377eef263441bc3868011ae7b7bdda
SHA-256: edc63be9c93ac03ed4592607ad760a3c629891007494d338465fba9031ff293b
Size: 1.34 MB - golang-bin-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.x86_64.rpm
MD5: a1e61803c250105a4a6d7feac2cfb9f0
SHA-256: 468d1c5f0c6d749e0cc50f4f2c2b95f1ebf2f78fed52f3cfb8ebeecbb1e6c5ce
Size: 40.16 MB - golang-docs-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.noarch.rpm
MD5: 12f2688db9073e41682f6e25252a15dd
SHA-256: c3266ee866451a5ae11f1a5db76f84f09b69d7db2437fcdb87596856d9dc576b
Size: 135.19 kB - golang-misc-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.noarch.rpm
MD5: d2f01f591e6d364d39729c82ed5ebc58
SHA-256: 7b68e33400c4a91de3a365c556ab87f30a8b4595930d3a705cd5495a4552cebd
Size: 59.73 kB - golang-race-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.x86_64.rpm
MD5: a39998308a0657b5743982e0625daaaf
SHA-256: 6e1ca3a44b50b3557be77f48b1557afad704ed79a0ae828fa38360281dc450f0
Size: 1.27 MB - golang-src-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.noarch.rpm
MD5: 6fb26c5ec9225335f06e709a2a2e2def
SHA-256: 99ec524d8bfebf8f129ffe91b4844de9af32f42d7a0dd7968ecfa228c7a4ba1c
Size: 11.57 MB - golang-tests-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.noarch.rpm
MD5: 5ed72689a32678f6c4030a60d5689863
SHA-256: 88bfbe2b2a6008eb63eb4b815d2613877f17b0f52d9fb2d63cb3dcffaa3c8955
Size: 10.77 MB - go-toolset-1.25.9-1.module+el8+1978+d9f3c3cc.ML.1.x86_64.rpm
MD5: edb5f1a93afdd20ac2d79ad8affa528d
SHA-256: f4e9d20e8fb5fdb6b319e7cb63dd626d2ffce29dab75ebd46d164a743f01bc71
Size: 33.28 kB
English