Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Red Hat Enterprise Linux 7 RHSA-2018:0878-01 Moderate: Golang Code Risks

red hat
Calendar Grey April 10, 2018
Dist Redhat Esm H88
Ubuntu Server 20.04 LTS patch for python addresses serious vulnerabilities related to unauthorized access and potential data leaks.
An update for golang is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The golang packages provide the Go programming language compiler.
The following packages have been upgraded to a later upstream version: golang (1.9.4). (BZ#1479095, BZ#1499827)
Security Fix(es):
* golang: arbitrary code execution during "go get" or "go get -d" (CVE-2017-15041)
* golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting (CVE-2017-15042)
* golang: arbitrary code execution during "go get" via C compiler options (CVE-2018-6574)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory update code execution Red Hat Enterprise Linux Moderate golang

References

https://access.redhat.com/security/cve/CVE-2017-15041 https://access.redhat.com/security/cve/CVE-2017-15042 https://access.redhat.com/security/cve/CVE-2018-6574 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html

Package List

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7):
Source: golang-1.9.4-1.el7.src.rpm
aarch64: golang-1.9.4-1.el7.aarch64.rpm golang-bin-1.9.4-1.el7.aarch64.rpm
noarch: golang-docs-1.9.4-1.el7.noarch.rpm golang-misc-1.9.4-1.el7.noarch.rpm golang-src-1.9.4-1.el7.noarch.rpm golang-tests-1.9.4-1.el7.noarch.rpm
ppc64le: golang-1.9.4-1.el7.ppc64le.rpm golang-bin-1.9.4-1.el7.ppc64le.rpm
s390x: golang-1.9.4-1.el7.s390x.rpm golang-bin-1.9.4-1.el7.s390x.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
Source: golang-1.9.4-1.el7.src.rpm
noarch: golang-docs-1.9.4-1.el7.noarch.rpm golang-misc-1.9.4-1.el7.noarch.rpm golang-src-1.9.4-1.el7.noarch.rpm golang-tests-1.9.4-1.el7.noarch.rpm
ppc64le: golang-1.9.4-1.el7.ppc64le.rpm golang-bin-1.9.4-1.el7.ppc64le.rpm
s390x: golang-1.9.4-1.el7.s390x.rpm golang-bin-1.9.4-1.el7.s390x.rpm
x86_64: golang-1.9.4-1.el7.x86_64.rpm golang-bin-1.9.4-1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Advisory ID: RHSA-2018:0878-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:0878
Issue date: 2018-04-10

Topic

An update for golang is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory update code execution Red Hat Enterprise Linux Moderate golang

Relevant Releases Architectures

Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64le, s390x, x86_64

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, noarch, ppc64le, s390x

Bugs Fixed

1498867 - CVE-2017-15042 golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting

1498870 - CVE-2017-15041 golang: arbitrary code execution during "go get" or "go get -d"

1543561 - CVE-2018-6574 golang: arbitrary code execution during "go get" via C compiler options

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here