Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Red Hat Enterprise Linux: RHSA-2021-4156 Moderate: go-toolset Bug Fix

red hat
Calendar Grey November 9, 2021
Scroller Redhat
Red Hat unveils tools-update:rhel8 revision tackling minor security vulnerabilities and correcting issues for RHEL 8.
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
The following packages have been upgraded to a later upstream version: golang (1.16.7). (BZ#1938071)
Security Fix(es):
* golang: net: lookup functions may return invalid host names (CVE-2021-33195)
* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
* golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory bug fix moderate severity Red Hat Enterprise network issue go-toolset http processing

References

https://access.redhat.com/security/cve/CVE-2021-33195 https://access.redhat.com/security/cve/CVE-2021-33197 https://access.redhat.com/security/cve/CVE-2021-33198 https://access.redhat.com/security/cve/CVE-2021-36221 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.5_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.src.rpm go-toolset-1.16.7-1.module+el8.5.0+12246+1aac4e3f.src.rpm golang-1.16.7-1.module+el8.5.0+12246+1aac4e3f.src.rpm
aarch64: go-toolset-1.16.7-1.module+el8.5.0+12246+1aac4e3f.aarch64.rpm golang-1.16.7-1.module+el8.5.0+12246+1aac4e3f.aarch64.rpm golang-bin-1.16.7-1.module+el8.5.0+12246+1aac4e3f.aarch64.rpm
noarch: golang-docs-1.16.7-1.module+el8.5.0+12246+1aac4e3f.noarch.rpm golang-misc-1.16.7-1.module+el8.5.0+12246+1aac4e3f.noarch.rpm golang-src-1.16.7-1.module+el8.5.0+12246+1aac4e3f.noarch.rpm golang-tests-1.16.7-1.module+el8.5.0+12246+1aac4e3f.noarch.rpm
ppc64le: go-toolset-1.16.7-1.module+el8.5.0+12246+1aac4e3f.ppc64le.rpm golang-1.16.7-1.module+el8.5.0+12246+1aac4e3f.ppc64le.rpm golang-bin-1.16.7-1.module+el8.5.0+12246+1aac4e3f.ppc64le.rpm
s390x: go-toolset-1.16.7-1.module+el8.5.0+12246+1aac4e3f.s390x.rpm golang-1.16.7-1.module+el8.5.0+12246+1aac4e3f.s390x.rpm golang-bin-1.16.7-1.module+el8.5.0+12246+1aac4e3f.s390x.rpm
x86_64: delve-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64.rpm delve-debuginfo-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64.rpm delve-debugsource-1.6.0-1.module+el8.5.0+10379+d6b83bd0.x86_64.rpm

Read the Full Advisory


Advisory ID: RHSA-2021:4156-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4156
Issue date: 2021-11-09

Topic

An update for the go-toolset:rhel8 module is now available for Red HatEnterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory bug fix moderate severity Red Hat Enterprise network issue go-toolset http processing

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

1972825 - FIPS mode AES CBC CryptBlocks incorrectly re-initializes IV in file crypto/internal/boring/aes.go

1976168 - TestBoringServerCurves from crypto/tls fails when executed separately [rhel-8]

1979100 - FIPS mode AES CBC Decrypter produces incorrect result

1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names

1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents

1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.