Security update for go1.18 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2005-1 Final 1 1 2022-06-07T14:34:56Z current 2022-06-07T14:34:56Z 2022-06-07T14:34:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for go1.18 This update for go1.18 fixes the following issues: Update to go1.18.3 (released 2022-06-01) (bsc#1193742): - CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers (bsc#1200134). - CVE-2022-30629: Fixed crypto/tls session tickets lack random ticket_age_add (bsc#1200135). - CVE-2022-29804: Fixed path/filepath Clean(`.\c:`) returns `c:` on Windows (bsc#1200137). - CVE-2022-30580: Fixed os/exec empty Cmd.Path can result in running unintended binary on Windows (bsc#1200136). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/golang:1.18-2022-2005,Container bci/golang:latest-2022-2005,SUSE-2022-2005,SUSE-SLE-Module-Development-Tools-15-SP3-2022-2005,SUSE-SLE-Module-Development-Tools-15-SP4-2022-2005,openSUSE-SLE-15.3-2022-2005,openSUSE-SLE-15.4-2022-2005 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222005-1/ Link for SUSE-SU-2022:2005-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011249.html E-Mail link for SUSE-SU-2022:2005-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193742 SUSE Bug 1193742 https://bugzilla.suse.com/1200134 SUSE Bug 1200134 https://bugzilla.suse.com/1200135 SUSE Bug 1200135 https://bugzilla.suse.com/1200136 SUSE Bug 1200136 https://bugzilla.suse.com/1200137 SUSE Bug 1200137 https://www.suse.com/security/cve/CVE-2022-29804/ SUSE CVE CVE-2022-29804 page https://www.suse.com/security/cve/CVE-2022-30580/ SUSE CVE CVE-2022-30580 page https://www.suse.com/security/cve/CVE-2022-30629/ SUSE CVE CVE-2022-30629 page https://www.suse.com/security/cve/CVE-2022-30634/ SUSE CVE CVE-2022-30634 page Container bci/golang:1.18 Container bci/golang:latest SUSE Linux Enterprise Module for Development Tools 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 go1.18-1.18.3-150000.1.20.1 go1.18-doc-1.18.3-150000.1.20.1 go1.18-race-1.18.3-150000.1.20.1 go1.18-1.18.3-150000.1.20.1 as a component of Container bci/golang:1.18 go1.18-1.18.3-150000.1.20.1 as a component of Container bci/golang:latest go1.18-1.18.3-150000.1.20.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 go1.18-doc-1.18.3-150000.1.20.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 go1.18-race-1.18.3-150000.1.20.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 go1.18-1.18.3-150000.1.20.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 go1.18-doc-1.18.3-150000.1.20.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 go1.18-race-1.18.3-150000.1.20.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 go1.18-1.18.3-150000.1.20.1 as a component of openSUSE Leap 15.3 go1.18-doc-1.18.3-150000.1.20.1 as a component of openSUSE Leap 15.3 go1.18-race-1.18.3-150000.1.20.1 as a component of openSUSE Leap 15.3 go1.18-1.18.3-150000.1.20.1 as a component of openSUSE Leap 15.4 go1.18-doc-1.18.3-150000.1.20.1 as a component of openSUSE Leap 15.4 go1.18-race-1.18.3-150000.1.20.1 as a component of openSUSE Leap 15.4 Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. CVE-2022-29804 Container bci/golang:1.18:go1.18-1.18.3-150000.1.20.1 Container bci/golang:latest:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-race-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-race-1.18.3-150000.1.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222005-1/ https://www.suse.com/security/cve/CVE-2022-29804.html CVE-2022-29804 https://bugzilla.suse.com/1200137 SUSE Bug 1200137 Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset. CVE-2022-30580 Container bci/golang:1.18:go1.18-1.18.3-150000.1.20.1 Container bci/golang:latest:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-race-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-race-1.18.3-150000.1.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222005-1/ https://www.suse.com/security/cve/CVE-2022-30580.html CVE-2022-30580 https://bugzilla.suse.com/1200136 SUSE Bug 1200136 Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. CVE-2022-30629 Container bci/golang:1.18:go1.18-1.18.3-150000.1.20.1 Container bci/golang:latest:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-race-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-race-1.18.3-150000.1.20.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222005-1/ https://www.suse.com/security/cve/CVE-2022-30629.html CVE-2022-30629 https://bugzilla.suse.com/1200135 SUSE Bug 1200135 Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. CVE-2022-30634 Container bci/golang:1.18:go1.18-1.18.3-150000.1.20.1 Container bci/golang:latest:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:go1.18-race-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-doc-1.18.3-150000.1.20.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.3:go1.18-race-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-doc-1.18.3-150000.1.20.1 openSUSE Leap 15.4:go1.18-race-1.18.3-150000.1.20.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222005-1/ https://www.suse.com/security/cve/CVE-2022-30634.html CVE-2022-30634 https://bugzilla.suse.com/1200134 SUSE Bug 1200134