SUSE-SU-2024:0812-1: Security update for go1.22

Q: Which systems and packages are covered by this update?

The update applies to SUSE openSUSE Leap 15.5 and the SUSE Development Tools Module 15-SP5 on aarch64, ppc64le, s390x, and x86_64. Listed packages include go1.22, go1.22-doc, and go1.22-race.

Q: What security-relevant behavior is addressed by the Go upgrade?

The update upgrades Go to 1.22.1 and addresses incorrect forwarding of sensitive headers and cookies during HTTP redirects, multipart-form memory exhaustion, a certificate-verification panic for unknown public-key algorithms, incorrect handling of comments in mail display names, and template escaping problems when MarshalJSON returns errors.

Published Mar 8, 2024

Updated

This update for go1.22 fixes the following issues: Upgrade go to version 1.22.1 CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000) CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001) CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999) CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002) CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)

Affected Software

8 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/go1.22-race<1.22.1-150000.1.9.1

1.22.1-150000.1.9.1

suse/go1.22-doc<1.22.1-150000.1.9.1

1.22.1-150000.1.9.1

suse/go1.22<1.22.1-150000.1.9.1

1.22.1-150000.1.9.1

All of the following

SUSE Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/go1.22-race<1.22.1-150000.1.9.1

1.22.1-150000.1.9.1

suse/go1.22-doc<1.22.1-150000.1.9.1

1.22.1-150000.1.9.1

suse/go1.22<1.22.1-150000.1.9.1

1.22.1-150000.1.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/go1.22-race to a version that resolves this vulnerability.
Fixed in 1.22.1-150000.1.9.1
Upgrade
Upgrade suse/go1.22-doc to a version that resolves this vulnerability.
Fixed in 1.22.1-150000.1.9.1
Upgrade
Upgrade suse/go1.22 to a version that resolves this vulnerability.
Fixed in 1.22.1-150000.1.9.1
Upgrade
Upgrade go1.22 to a version that resolves this vulnerability.
Fixed in 1.22.1

Event History

Mar 8, 2024

Advisory Published

via SUSE·08:30 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems and packages are covered by this update?

The update applies to SUSE openSUSE Leap 15.5 and the SUSE Development Tools Module 15-SP5 on aarch64, ppc64le, s390x, and x86_64. Listed packages include go1.22, go1.22-doc, and go1.22-race.

What security-relevant behavior is addressed by the Go upgrade?

The update upgrades Go to 1.22.1 and addresses incorrect forwarding of sensitive headers and cookies during HTTP redirects, multipart-form memory exhaustion, a certificate-verification panic for unknown public-key algorithms, incorrect handling of comments in mail display names, and template escaping problems when MarshalJSON returns errors.

SUSE-SU-2024:0812-1: Security update for go1.22

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems and packages are covered by this update?

What security-relevant behavior is addressed by the Go upgrade?

Company

Resources

Contact

Frequently Asked Questions

Which systems and packages are covered by this update?

What security-relevant behavior is addressed by the Go upgrade?