RHSA-2022:5866: Important: go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
Go Toolset provides the Go programming language tools and libraries. Go isalternatively known as golang.Security Fix(es): golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) golang: go/parser: stack exhaustion in all Parse functions (CVE-2022-1962) golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): Clean up dist-git patches (BZ#2109172) Update Go to version 1.17.12 (BZ#2109184)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-build-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-bin-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-docs-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-misc-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-race-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-src-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-golang-tests-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-runtime-1.17.12-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.17-scldevel-1.17.12-1.el7_9 - Upgrade
Upgrade
Goto a version that resolves this vulnerability.Fixed in 1.17.12
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:5866?
The severity of RHSA-2022:5866 is classified as moderate.
How do I fix RHSA-2022:5866?
To fix RHSA-2022:5866, update the affected packages to the remedial versions, such as 1.17-1.17.12-1.el7_9.
What vulnerabilities are addressed in RHSA-2022:5866?
RHSA-2022:5866 addresses vulnerabilities including a stack exhaustion issue in compress/gzip and an improper handling issue in net/http.
Which versions of Go Toolset are affected by RHSA-2022:5866?
Affected versions of Go Toolset under RHSA-2022:5866 include all versions prior to 1.17-1.17.12-1.el7_9.
Is there a specific CVE associated with RHSA-2022:5866?
Yes, RHSA-2022:5866 references CVE-2022-30631, which pertains to the stack exhaustion in Reader.Read.