Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

SUSE: 2021:0937-1 Moderate: Resolved Issues in Go1.16 Released

suse
Calendar Grey March 24, 2021
Dist Suse Esm H88
The latest update for go1.16 on SUSE addresses significant vulnerabilities rated as moderate and provides detailed guidelines for installation.
An update that solves two vulnerabilities and has one errata is now available

Summary

This update for go1.16 fixes the following issues: - go1.16.2 (released 2021-03-11) (bsc#1182345) - go1.16.1 (released 2021-03-10) (bsc#1182345) - CVE-2021-27918: Fixed an infinite loop when using xml.NewTokenDecoder with a custom TokenReader (bsc#1183333). - CVE-2021-27919: Fixed an issue where archive/zip: can panic when calling Reader.Open (bsc#1183334). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Development Tools 15-SP2: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP2-2021-937=1 Package List:

Topics%20covered

Topics Covered

security advisory moderate software patch SUSE Go programming

References

#1182345 #1183333 #1183334

Cross- CVE-2021-27918 CVE-2021-27919

CVSS scores:

CVE-2021-27918 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2021-27919 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected Products:

SUSE Linux Enterprise Module for Development Tools 15-SP2

https://www.suse.com/security/cve/CVE-2021-27918.html

https://www.suse.com/security/cve/CVE-2021-27919.html

https://bugzilla.suse.com/1182345

https://bugzilla.suse.com/1183333

https://bugzilla.suse.com/1183334

Announcement ID: SUSE-SU-2021:0937-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate software patch SUSE Go programming

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.