MGASA-2023-0227 - Updated golang packages fix security vulnerability

Publication date: 07 Jul 2023
URL: https://advisories.mageia.org/MGASA-2023-0227.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2023-29402,
     CVE-2023-29403,
     CVE-2023-29404,
     CVE-2023-29405

Code injection via go command with cgo in cmd/go (CVE-2023-29402)
Ignoring setuid/setgid bits. (CVE-2023-29403)
Arbitrary code execution (CVE-2023-29404)
Arbitrary code execution (CVE-2023-29405)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32052
- https://groups.google.com/g/golang-announce/c/q5135a9d924
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29402
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29403
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29404
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29405

SRPMS:
- 8/core/golang-1.19.10-1.mga8