Moderate: go-toolset:rhel8 security and bug fix update
Summary
ALSA-2023:3083: Moderate: go-toolset:rhel8 security and bug fix update. Affects delve versions < 1.9.1-1.module_el8.8.0+3471+a62632a0. Fixed in 1.9.1-1.module_el8.8.0+3471+a62632a0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Vulnerability Detail
This vulnerability affects the go-toolset package in RHEL 8. It includes two security fixes:
- CVE-2022-41724: Large handshake records in the crypto/tls package may cause panics.
- CVE-2022-41725: The net/http and mime/multipart packages are vulnerable to denial of service attacks due to excessive resource consumption.
These vulnerabilities can lead to various security issues, including crashes, resource exhaustion, and potential remote code execution.
How To Fix
Minimum fixed version
1.9.1-1.module_el8.8.0+3471+a62632a0
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The go-toolset package in RHEL 8 is affected by two security vulnerabilities. It is crucial to update to version 1.19.6 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for delve →
FAQ
Go Toolset provides the Go programming language tools and libraries.
CVE-2022-41724 is a vulnerability in the crypto/tls package that can cause panics due to large handshake records.
CVE-2022-41725 is a vulnerability in the net/http and mime/multipart packages that can lead to denial of service attacks through excessive resource consumption.
These vulnerabilities can result in crashes, resource exhaustion, and potential remote code execution.
To fix the vulnerabilities, update the go-toolset package to version 1.19.6 or later.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
