Important: go-toolset and golang security and bug fix update
Summary
ALSA-2023:5738: Important: go-toolset and golang security and bug fix update. Affects go-toolset versions < 1.19.13-1.el9_2. Fixed in 1.19.13-1.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler.
Vulnerability Detail
Multiple vulnerabilities have been identified in go-toolset and golang packages. The first vulnerability (CVE-2023-44487) affects the net/http and x/net/http2 modules, where rapid stream resets can cause excessive work. This vulnerability can be exploited to launch a Denial of Service (DoS) attack. The second vulnerability (CVE-2023-29409) affects the crypto/tls module, leading to slow verification of certificate chains containing large RSA keys. These vulnerabilities can have a significant impact on the security and performance of applications utilizing the affected packages.
How To Fix
Minimum fixed version
1.19.13-1.el9_2
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update the go-toolset and golang packages to address the identified vulnerabilities. Failure to do so may result in security breaches and performance issues. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for go-toolset →
FAQ
Go Toolset provides the Go programming language tools and libraries.
Golang is an alternative name for the Go programming language.
CVE-2023-44487 can be exploited to launch a Denial of Service (DoS) attack by causing rapid stream resets, resulting in excessive work for the affected server.
CVE-2023-29409 can lead to slow verification of certificate chains containing large RSA keys, impacting the performance of applications utilizing the affected crypto/tls module.
To update the packages, run the package manager update command specific to your operating system.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
