Security update for go1.14 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3369-1 Final 1 1 2020-11-19T08:26:22Z current 2020-11-19T08:26:22Z 2020-11-19T08:26:22Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for go1.14 This update for go1.14 fixes the following issues: - go1.14.12 (released 2020-11-12) includes security fixes to the cmd/go and math/big packages. * go#42553 math/big: panic during recursive division of very large numbers (bsc#1178750 CVE-2020-28362) * go#42560 cmd/go: arbitrary code can be injected into cgo generated files (bsc#1178752 CVE-2020-28367) * go#42557 cmd/go: improper validation of cgo flags can lead to remote code execution at build time (bsc#1178753 CVE-2020-28366) * go#42155 time: Location interprets wrong timezone (DST) with slim zoneinfo * go#42112 x/net/http2: the first write error on a connection will cause all subsequent write requests to fail blindly * go#41991 runtime: macOS-only segfault on 1.14+ with 'split stack overflow' * go#41913 net/http: request.Clone doesn't deep copy TransferEncoding * go#41703 runtime: macOS syscall.Exec can get SIGILL due to preemption signal * go#41386 x/net/http2: connection-level flow control not returned if stream errors, causes server hang The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-3369,SUSE-SLE-Module-Development-Tools-15-SP1-2020-3369,SUSE-SLE-Module-Development-Tools-15-SP2-2020-3369 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203369-1/ Link for SUSE-SU-2020:3369-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007807.html E-Mail link for SUSE-SU-2020:3369-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1164903 SUSE Bug 1164903 https://bugzilla.suse.com/1178750 SUSE Bug 1178750 https://bugzilla.suse.com/1178752 SUSE Bug 1178752 https://bugzilla.suse.com/1178753 SUSE Bug 1178753 https://www.suse.com/security/cve/CVE-2020-28362/ SUSE CVE CVE-2020-28362 page https://www.suse.com/security/cve/CVE-2020-28366/ SUSE CVE CVE-2020-28366 page https://www.suse.com/security/cve/CVE-2020-28367/ SUSE CVE CVE-2020-28367 page SUSE Linux Enterprise Module for Development Tools 15 SP1 SUSE Linux Enterprise Module for Development Tools 15 SP2 go1.14-1.14.12-1.26.1 go1.14-doc-1.14.12-1.26.1 go1.14-race-1.14.12-1.26.1 go1.14-1.14.12-1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP1 go1.14-doc-1.14.12-1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP1 go1.14-1.14.12-1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 go1.14-doc-1.14.12-1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. CVE-2020-28362 SUSE Linux Enterprise Module for Development Tools 15 SP1:go1.14-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP1:go1.14-doc-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.14-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.14-doc-1.14.12-1.26.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203369-1/ https://www.suse.com/security/cve/CVE-2020-28362.html CVE-2020-28362 https://bugzilla.suse.com/1178750 SUSE Bug 1178750 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file. CVE-2020-28366 SUSE Linux Enterprise Module for Development Tools 15 SP1:go1.14-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP1:go1.14-doc-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.14-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.14-doc-1.14.12-1.26.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203369-1/ https://www.suse.com/security/cve/CVE-2020-28366.html CVE-2020-28366 https://bugzilla.suse.com/1178753 SUSE Bug 1178753 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive. CVE-2020-28367 SUSE Linux Enterprise Module for Development Tools 15 SP1:go1.14-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP1:go1.14-doc-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.14-1.14.12-1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.14-doc-1.14.12-1.26.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203369-1/ https://www.suse.com/security/cve/CVE-2020-28367.html CVE-2020-28367 https://bugzilla.suse.com/1178752 SUSE Bug 1178752