Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Mageia 7: 2020-0325 Moderate: Golang Data Race and Input Issues

mageia
Calendar Grey August 18, 2020
Dist Mageia Esm H88
The recent golang upgrade from Mageia addresses significant security flaws, improving both the safety and reliability of server systems.
Servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash

Summary

Servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected (CVE-2020-15586).
Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This could lead to processing more input than expected when the caller is reading directly from the network and depends on ReadUvarint and ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs (CVE-2020-16845).
The golang package has been updated to version 1.13.15, fixing these issues and containing several other bug fixes and enhancements. See the 1.13 release notes and other references for details.

References

- https://bugs.mageia.org/show_bug.cgi?id=27039

- https://go.dev/doc/go1.13

- https://go.dev/doc/devel/release

- https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/golang-announce/XZNfaiwgt2w/E6gHDs32AQAJ

- https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!topic/golang-announce/NyPIaucMgXo

- - https://www.cve.org/CVERecord?id=CVE-2020-15586

- https://www.cve.org/CVERecord?id=CVE-2020-16845

Topics%20covered

Topics Covered

security advisory software update security fix golang Mageia data race network input

Resolution

SRPMS

- 7/core/golang-1.13.15-1.mga7

Publication date: 18 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0325.html
Type: security
CVE: CVE-2020-15586, CVE-2020-16845

Topics%20covered

Topics Covered

security advisory software update security fix golang Mageia data race network input

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here