SUSE-RU-2024:0734-1: Recommended update for go1.21
This update for go1.21 fixes the following issues: go1.21.7 (released 2024-02-06) includes fixes to the compiler, the go command, the runtime, and the crypto/x509 package. (bsc#1212475 go1.21 release tracking) go#63209 runtime: "fatal: morestack on g0" on amd64 after upgrade to Go 1.21 go#63768 runtime: pinner.Pin doesn't panic when it says it will go#64497 cmd/go: flag modcacherw does not take effect in the target package go#64761 staticlockranking builders failing on release branches on LUCI go#64935 runtime: "traceback: unexpected SPWRITE function runtime.systemstack" go#65023 x/tools/go/analysis/unitchecker,slices: TestVetStdlib failing due to vet errors in panic tests go#65053 cmd/compile: //go:build file version ignored when calling generic fn which has related type params go#65323 crypto: rollback BoringCrypto fips-20220613 update go#65351 cmd/go: go generate fails silently when run on a package in a nested workspace module go#65380 crypto/x509: TestIssue51759 consistently failing on gotip-darwin-amd6410.15 LUCI builder go#65449 runtime/trace: frame pointer unwinding crash on arm64 during async preemption
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/go1.21to a version that resolves this vulnerability.Fixed in 1.21.7-150000.1.24.1 - Upgrade
Upgrade
suse/go1.21-docto a version that resolves this vulnerability.Fixed in 1.21.7-150000.1.24.1 - Upgrade
Upgrade
suse/go1.21-raceto a version that resolves this vulnerability.Fixed in 1.21.7-150000.1.24.1 - Upgrade
Upgrade
suse/container-suseconnectto a version that resolves this vulnerability.Fixed in 2.4.0-150000.4.50.2 - Upgrade
Upgrade
suse/container-suseconnect-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.0-150000.4.50.2 - Upgrade
Upgrade
goto a version that resolves this vulnerability.Fixed in 1.21.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Containers-15-SP5-2024-734=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-734=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-734=1
Event History
Frequently Asked Questions
Which systems and packages are covered by this update?
The update applies to SUSE openSUSE Leap 15.5, SUSE Containers Module 15-SP5, and SUSE Development Tools Module 15-SP5 on aarch64, ppc64le, s390x, and x86_64. Listed packages include go1.21, go1.21-doc, go1.21-race, container-suseconnect, and container-suseconnect-debuginfo.
Does the advisory describe an attacker-controlled exploit path or affected default configuration?
No. The supplied advisory information describes fixes for Go compiler, command, runtime, and crypto/x509 issues, but does not provide attacker prerequisites, exposure conditions, or default-configuration impact.
How can an administrator identify potentially affected installations?
Check whether the listed go1.21-related packages are installed on one of the covered SUSE 15-SP5 products. Systems that have not received the update containing go1.21.7 should be reviewed for update applicability.