Security update for go1.20 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:4018-1 Final 1 1 2023-10-09T17:24:03Z current 2023-10-09T17:24:03Z 2023-10-09T17:24:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for go1.20 This update for go1.20 fixes the following issues: - Updated to version 1.20.9 (bsc#1206346): - CVE-2023-39323: Fixed an arbitrary execution issue during build time due to path directive bypass (bsc#1215985). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/golang:1.20-2023-4018,SUSE-2023-4018,SUSE-SLE-Module-Development-Tools-15-SP4-2023-4018,SUSE-SLE-Module-Development-Tools-15-SP5-2023-4018,openSUSE-SLE-15.4-2023-4018,openSUSE-SLE-15.5-2023-4018 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20234018-1/ Link for SUSE-SU-2023:4018-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016573.html E-Mail link for SUSE-SU-2023:4018-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1206346 SUSE Bug 1206346 https://bugzilla.suse.com/1215985 SUSE Bug 1215985 https://www.suse.com/security/cve/CVE-2023-39323/ SUSE CVE CVE-2023-39323 page Container bci/golang:1.20 SUSE Linux Enterprise Module for Development Tools 15 SP4 SUSE Linux Enterprise Module for Development Tools 15 SP5 openSUSE Leap 15.4 openSUSE Leap 15.5 go1.20-1.20.9-150000.1.26.1 go1.20-doc-1.20.9-150000.1.26.1 go1.20-race-1.20.9-150000.1.26.1 go1.20-1.20.9-150000.1.26.1 as a component of Container bci/golang:1.20 go1.20-doc-1.20.9-150000.1.26.1 as a component of Container bci/golang:1.20 go1.20-race-1.20.9-150000.1.26.1 as a component of Container bci/golang:1.20 go1.20-1.20.9-150000.1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 go1.20-doc-1.20.9-150000.1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 go1.20-race-1.20.9-150000.1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP4 go1.20-1.20.9-150000.1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 go1.20-doc-1.20.9-150000.1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 go1.20-race-1.20.9-150000.1.26.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP5 go1.20-1.20.9-150000.1.26.1 as a component of openSUSE Leap 15.4 go1.20-doc-1.20.9-150000.1.26.1 as a component of openSUSE Leap 15.4 go1.20-race-1.20.9-150000.1.26.1 as a component of openSUSE Leap 15.4 go1.20-1.20.9-150000.1.26.1 as a component of openSUSE Leap 15.5 go1.20-doc-1.20.9-150000.1.26.1 as a component of openSUSE Leap 15.5 go1.20-race-1.20.9-150000.1.26.1 as a component of openSUSE Leap 15.5 Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex. CVE-2023-39323 Container bci/golang:1.20:go1.20-1.20.9-150000.1.26.1 Container bci/golang:1.20:go1.20-doc-1.20.9-150000.1.26.1 Container bci/golang:1.20:go1.20-race-1.20.9-150000.1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.20-1.20.9-150000.1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.20-doc-1.20.9-150000.1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP4:go1.20-race-1.20.9-150000.1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:go1.20-1.20.9-150000.1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:go1.20-doc-1.20.9-150000.1.26.1 SUSE Linux Enterprise Module for Development Tools 15 SP5:go1.20-race-1.20.9-150000.1.26.1 openSUSE Leap 15.4:go1.20-1.20.9-150000.1.26.1 openSUSE Leap 15.4:go1.20-doc-1.20.9-150000.1.26.1 openSUSE Leap 15.4:go1.20-race-1.20.9-150000.1.26.1 openSUSE Leap 15.5:go1.20-1.20.9-150000.1.26.1 openSUSE Leap 15.5:go1.20-doc-1.20.9-150000.1.26.1 openSUSE Leap 15.5:go1.20-race-1.20.9-150000.1.26.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234018-1/ https://www.suse.com/security/cve/CVE-2023-39323.html CVE-2023-39323 https://bugzilla.suse.com/1215985 SUSE Bug 1215985