Security update for go1.17 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3833-1 Final 1 1 2021-12-01T15:04:57Z current 2021-12-01T15:04:57Z 2021-12-01T15:04:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for go1.17 This update for go1.17 fixes the following issues: Security update go1.17.3 (released 2021-11-04) (bsc#1190649). - CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377). - CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/golang:1.17-2021-3833,SUSE-2021-3833,SUSE-SLE-Module-Development-Tools-15-SP2-2021-3833,SUSE-SLE-Module-Development-Tools-15-SP3-2021-3833 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213833-1/ Link for SUSE-SU-2021:3833-1 https://lists.suse.com/pipermail/sle-security-updates/2021-December/009791.html E-Mail link for SUSE-SU-2021:3833-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1190649 SUSE Bug 1190649 https://bugzilla.suse.com/1192377 SUSE Bug 1192377 https://bugzilla.suse.com/1192378 SUSE Bug 1192378 https://www.suse.com/security/cve/CVE-2021-41771/ SUSE CVE CVE-2021-41771 page https://www.suse.com/security/cve/CVE-2021-41772/ SUSE CVE CVE-2021-41772 page Container bci/golang:1.17 SUSE Linux Enterprise Module for Development Tools 15 SP2 SUSE Linux Enterprise Module for Development Tools 15 SP3 go1.17-1.17.3-1.9.1 go1.17-doc-1.17.3-1.9.1 go1.17-race-1.17.3-1.9.1 go1.17-1.17.3-1.9.1 as a component of Container bci/golang:1.17 go1.17-1.17.3-1.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 go1.17-doc-1.17.3-1.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 go1.17-race-1.17.3-1.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP2 go1.17-1.17.3-1.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 go1.17-doc-1.17.3-1.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 go1.17-race-1.17.3-1.9.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. CVE-2021-41771 Container bci/golang:1.17:go1.17-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.17-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.17-doc-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.17-race-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.17-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.17-doc-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.17-race-1.17.3-1.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213833-1/ https://www.suse.com/security/cve/CVE-2021-41771.html CVE-2021-41771 https://bugzilla.suse.com/1192377 SUSE Bug 1192377 Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field. CVE-2021-41772 Container bci/golang:1.17:go1.17-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.17-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.17-doc-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP2:go1.17-race-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.17-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.17-doc-1.17.3-1.9.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.17-race-1.17.3-1.9.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213833-1/ https://www.suse.com/security/cve/CVE-2021-41772.html CVE-2021-41772 https://bugzilla.suse.com/1192378 SUSE Bug 1192378