Ubuntu 23.04 and 22.10 USN-6140-1 Moderate: Go DoS Risk

ubuntu

June 6, 2023

Several security issues were fixed in Go.

Summary

Several security issues were fixed in Go.

Software Description:

- golang-1.19: Go programming language compiler - metapackage

- golang-1.20: Go programming language compiler - metapackage

Details:

It was discovered that Go did not properly manage memory under certain

circumstances. An attacker could possibly use this issue to cause a panic

resulting in a denial of service. This issue only affected golang-1.19 on

Ubuntu 22.10. (CVE-2022-41724, CVE-2023-24534, CVE-2023-24537)

It was discovered that Go did not properly validate the amount of memory

and disk files ReadForm can consume. An attacker could possibly use this

issue to cause a panic resulting in a denial of service. This issue only

affected golang-1.19 on Ubuntu 22.10. (CVE-2022-41725)

It was discovered that Go did not properly validate backticks (`) as

Javascript string delimiters, and did not escape them as expected. An

attacker could possibly use this issue to inject arbitrary Javascript code

into the Go template. Th...

Read the Full Advisory

Topics Covered

security advisory security issue software update DoS Ubuntu memory management Go

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
  golang-1.19                     1.19.8-1ubuntu0.1
  golang-1.19-go                  1.19.8-1ubuntu0.1
  golang-1.19-src                 1.19.8-1ubuntu0.1
  golang-1.20                     1.20.3-1ubuntu0.1
  golang-1.20-go                  1.20.3-1ubuntu0.1
  golang-1.20-src                 1.20.3-1ubuntu0.1

Ubuntu 22.10:
  golang-1.19                     1.19.2-1ubuntu1.1
  golang-1.19-go                  1.19.2-1ubuntu1.1
  golang-1.19-src                 1.19.2-1ubuntu1.1

In general, a standard system update will make all the necessary changes.