Moderate: go-toolset security update
Summary
ALSA-2024:4237: Moderate: go-toolset security update. Affects delve versions < 1.21.2-3.module_el8.10.0+3760+4dd778f9. Fixed in 1.21.2-3.module_el8.10.0+3760+4dd778f9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Vulnerability Detail
The vulnerability in Go Toolset is related to two security issues:
-
CVE-2024-24789: Incorrect handling of certain ZIP files in the archive/zip package.
-
CVE-2024-24790: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in the net/netip package.
These vulnerabilities can potentially lead to various security risks and impact the overall stability and reliability of applications built using Go Toolset.
How To Fix
Minimum fixed version
1.21.2-3.module_el8.10.0+3760+4dd778f9
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to promptly update the affected packages to mitigate the security risks associated with these vulnerabilities in Go Toolset.
See every vulnerability recorded for delve →
FAQ
Go Toolset is a collection of tools and libraries for the Go programming language.
CVE-2024-24789 is a vulnerability in the archive/zip package of Go Toolset that can result in incorrect handling of certain ZIP files.
CVE-2024-24790 is a vulnerability in the net/netip package of Go Toolset that can cause unexpected behavior from Is methods for IPv4-mapped IPv6 addresses.
These vulnerabilities can potentially lead to security breaches, data corruption, or denial of service attacks in applications built using Go Toolset.
You can update the affected packages by using the package manager or manually downloading and installing the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
