go-toolset:rhel8 security, bug fix, and enhancement update

エラータID: AXSA:2026-1326:01

リリース日: 
2026/07/22 Wednesday - 18:08
題名: 
go-toolset:rhel8 security, bug fix, and enhancement update
影響のあるチャネル: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

以下項目について対処しました。

[Security Fix]
- Golang の crypto/x509 パッケージには、リモートの攻撃者により、
巧妙に細工された X.509 証明書ファイルを介して、サービス拒否攻撃
を可能とする脆弱性が存在します。(CVE-2026-27145)

- Golang の idna コンポーネントには、リモートの攻撃者により巧妙
に細工された Punycode ラベルを介して、特権昇格を可能とする脆弱性
が存在します。(CVE-2026-39821)

- Golang の os パッケージには、シンボリックリンクの解釈処理に
問題があるため、ローカルの攻撃者により、情報の漏洩、データ破壊、
およびサービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2026-39822)

Modularity name: go-toolset
Stream name: rhel8

解決策: 

パッケージをアップデートしてください。

CVE: 
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
CVE-2026-39821
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
CVE-2026-39822
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
追加情報: 

N/A

ダウンロード: 

SRPMS
  1. delve-1.26.1-1.module+el8+2007+d8ef8f48.ML.1.src.rpm
    MD5: d0bb66a5f24a62119bbb4fbbb3e01040
    SHA-256: 7238e7b7e11a95cfeaf5625314f1932c6c2ec02548bb40a607609c60636fbe70
    Size: 9.09 MB
  2. golang-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.src.rpm
    MD5: 9ce769d82b0e654f5fecdf87669498ff
    SHA-256: 4ed3c737a1dea8f71c790e89cb89b0ba92568b667b23e839c9fbb740766f308f
    Size: 34.84 MB

Asianux Server 8 for x86_64
  1. delve-1.26.1-1.module+el8+2007+d8ef8f48.ML.1.x86_64.rpm
    MD5: b0af1644eab22c97075bc44aa60915df
    SHA-256: a66192d8491431b503e3884cc750383b93546e6d9292b8d5bb853533d8e3c595
    Size: 5.73 MB
  2. delve-debugsource-1.26.1-1.module+el8+2007+d8ef8f48.ML.1.x86_64.rpm
    MD5: 998950a286ae2172589bd1ce746b70ff
    SHA-256: aa3c3f2a3cf4ede8db34cfa9e92e32c649aad22c82ebb594f7116731d76f595d
    Size: 1.29 MB
  3. golang-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.x86_64.rpm
    MD5: 61eb5b2e8a307c95806a3f9cdff5ef9e
    SHA-256: 6aa6a4187be23a072f406fe129444bfb531be4b1017ca25f8dd4d24b7ad32141
    Size: 1.52 MB
  4. golang-bin-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.x86_64.rpm
    MD5: 2fbdf156d12e8645a61b5a1d3f0032da
    SHA-256: e0c9866aed9062b9261d51ca73b101dc231570aeb9bf64fba26342d14d21d249
    Size: 47.55 MB
  5. golang-docs-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.noarch.rpm
    MD5: 9f5385f78046a1987756084588b248df
    SHA-256: ea75434ee19e6f86b45cfeec674546d14e3a50f1cf020232368fb6d0aafd71ef
    Size: 135.76 kB
  6. golang-misc-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.noarch.rpm
    MD5: e96145b44981bc0227a35200d4d7230f
    SHA-256: 91e846625a1576fc21dd6fa762c36c910eac93881e25ecc787dffc851be6ade1
    Size: 60.02 kB
  7. golang-race-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.x86_64.rpm
    MD5: 812a3c6515626a211a8800dbcdf77e87
    SHA-256: 0e2c3433e6732eef4a1d199d8a1d7c7834407ce77235721579204a0a6e45548d
    Size: 1.27 MB
  8. golang-src-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.noarch.rpm
    MD5: 3773ac7cb2eeccff071f438ccc44408a
    SHA-256: 065574ee0852af552850b4a954aa1b71608751f2a149f9dcf260b8dd2819cbc0
    Size: 12.24 MB
  9. golang-tests-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.noarch.rpm
    MD5: b79b2c4ac8f91855ac2e4bed2ee396cb
    SHA-256: 6df7ba1ef27fafb0ebf596ecf97e656174f09da188070cbbe40dded1cf066fa7
    Size: 11.31 MB
  10. go-toolset-1.26.5-1.module+el8+2007+d8ef8f48.ML.1.x86_64.rpm
    MD5: df13adb9af023960b7f11503f763c5de
    SHA-256: 66a260bbf85c1859fe1706a23ee062ea46b14e954366333cd7b83f651ba2e74d
    Size: 33.56 kB