Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

openSUSE Leap 15.4: 2022:0723-1 Important: Go1.17 Access Control Issue

opensuse
Calendar Grey March 4, 2022
Dist Opensuse Esm H88
openSUSE releases a critical patch for go1.17 tackling various security flaws and enhancing performance.
An update that solves three vulnerabilities and has one errata is now available

Description

This update for go1.17 fixes the following issues:

- CVE-2022-23806: Fixed incorrect returned value in crypto/elliptic

IsOnCurve (bsc#1195838).

- CVE-2022-23772: Fixed overflow in Rat.SetString in math/big can lead to

uncontrolled memory consumption (bsc#1195835).

- CVE-2022-23773: Fixed incorrect access control in cmd/go (bsc#1195834).

The following non-security bugs were fixed:

- go#50978 crypto/elliptic: IsOnCurve returns true for invalid field

elements

- go#50701 math/big: Rat.SetString may consume large amount of RAM and

crash

- go#50687 cmd/go: do not treat branches with semantic-version names as

releases

- go#50942 cmd/asm: "compile: loop" compiler bug?

- go#50867 cmd/compile: incorrect use of CMN on arm64

- go#50812 cmd/go: remove bitbucket VCS probing

- go#50781 runtime: incorrect frame information in traceback traversal may

hang the process.

- go#50722 debug/pe: reading debug_info section of PE files...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.4:

zypper in -t patch openSUSE-SLE-15.4-2022-723=1

- openSUSE Leap 15.3:

zypper in -t patch openSUSE-SLE-15.3-2022-723=1

Package List

- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):

go1.17-1.17.7-1.20.1

go1.17-doc-1.17.7-1.20.1

- openSUSE Leap 15.4 (aarch64 x86_64):

go1.17-race-1.17.7-1.20.1

- openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64):

go1.17-1.17.7-1.20.1

go1.17-doc-1.17.7-1.20.1

- openSUSE Leap 15.3 (aarch64 x86_64):

go1.17-race-1.17.7-1.20.1

References

https://www.suse.com/security/cve/CVE-2022-23772.html

https://www.suse.com/security/cve/CVE-2022-23773.html

https://www.suse.com/security/cve/CVE-2022-23806.html

https://bugzilla.suse.com/1190649

https://bugzilla.suse.com/1195834

https://bugzilla.suse.com/1195835

https://bugzilla.suse.com/1195838

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2022:0723-1
Rating: important
Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ble.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here