-----BEGIN PGP PUBLIC KEY BLOCK-----
xsFNBGT1vF8BEAC2w6Af0VgaEvUzWv6T0qj98y+DqoSm76w3SdXg1rTgR/pX3a9c
tlfnoCZcyeSf+ttUnkha9vyzFfhz0u5IFDehqadQyfBCxemeEA+b1KBhSMGpiuRd
KMwOggQObp7oGdjImQRDT2CfQOWg1KsVk2o4lIuYZNcg8BWSyVlKxXEJ+hKmeDmO
P53rzY7l/gSHaeJ2bpYY5dCw0OLVLb/3QdrPthvYg4zvGzgvVwEKGsocADboqFYk
GuffEuYe1DYOCXbAx6Q59ZP/V7IlIFE9kiUpOAAAf6r/qkVBm3Zj4DtTuTMipsdJ
A6cQvvuMx9Qm37u7fOhosdNczZ2Zt38bLu9Gz2oL9mG0YBCe8Qfgf+pXLc6BKOLB
dwymVtV43cz7vlDOhRojWpsVxggV1FecjJ+cdP4FWAusE11ST60pY/W+y61MLzfs
qy3O3MIoQjXBaEGGTtPiEpVeZL+1v8aJuB5sJLAj56OmgSpcc7NqBHwUgjoeMA4y
87utHUSr4II/Ay1H4xOEZoCE+vIC61G32TwTco3WMhtISSOnRZHsc6GRuBeVr5fq
xEvmmo8lG+u5IgDpakbC/OpDxzemCiYJWCiUgF7X7VnlLLBVyxUMv9P1edursuk1
E2W5sl7RYIiPos23YU/Q66rER/egPX6YmsAr38FcqGYh9ZOauSfmKQ0pDwARAQAB
zVVEYXZpZCBGZXJuYW5kZXogR29uemFsZXogKFNpZ24gKyBlbmNyeXB0IGtleSkg
PGRhdmlkLmZlcm5hbmRlemdvbnphbGV6QGNhbm9uaWNhbC5jb20+wsGUBBMBCgA+
FiEELi4vmPVwZWdpuqdqlvdwxzm8Ws4FAmT1vF8CGwMFCQICKQAFCwkIBwIGFQoJ
CAsCBBYCAwECHgECF4AACgkQlvdwxzm8Ws5bUBAAkWPMosnc2/qqCyLSxkO5ACoT
p527SNCSJU0oQqHghxa7dLQr4NrjMsiNIR3GzVl+IeOR3BvIIwGl3VwQ110dAegX
kQ7jSq6k5bMT9UWJ5O6ju47cxQ1QzYwp5xD1rel8CPouvHHoqIGF0IWB74/BDPRK
7HPsip0P/mQFDaqm/lfxJXE9ZX/nsrqfzQpPMMyChXQbkMYr3Nw5j5AiOwHIZX2c
NksAiziNhzqjK5zPRYLIAwMuFgSyAOoBQamclRbPSNEV5A4D+jOflFy4II636ZEh
gs8+e8ggMb4tCofgolHLOzgzOReClVed6jegQI3rU/YFiyA8oC5pEnTk3qnc6Uzd
Fsrmh8nj2sSElcIf6HL2AITyzbja6MHSbNa5yoVqePQNZySYn+odOHA5TETR8U1p
KGs5oNQvMvWIW+o8t8m+di/a3vwzl9M4HnwCAM513qnv5Bqt/qucedCSFNQvf0Xs
f+2YxWckYC6w0QjJyvR22zYrhd4K87rr6HTu+qeonnivU1ePSc6SMEbvHS8uWgh0
nN+qCxkh4UzqBL2qnkRxB3VGF1peLGPjefmIkGt236B9/xkEcSOD7ZHz9xa00jQx
3tDLTHnelsLvk8gnIaBku0cnMtCo5DUyOH04pKif7uhbPLkNbEy4zyD9ga2hoX5R
gkeELpyDEi6bhMs66z/OwU0EZPW8XwEQAM/loHx2tM4KYXFBrQmsaFlOHFHTrj80
hMWDM4KEXo9+ufaXZnoJFAjo4Dmh+MT4Xcfs1ooowoWlik6nDQ6DwYtk237YwK/f
s4H/SbZ/p3uwdN+vCcXcQm5lUf927iVALCE9jJBwZrfr5EA808elZZzQSCT05lMm
lnHICso+l1qjysReXb6mzFqGGvgRtU9HnvkFKW8dx4W/++VVSJP7tf2aKVcpyWj4
GrS8I+4S6RYDMlUGNky1/fZWZsuJPv0Prv6NqhS/8QbwpI3b0RwK//ZF7ur8KIHE
+fiA8weqxHGQG0pAOZNgCjc5YF9sz4ooMZMhQHKVRknNVcGng6HORaZJkKtZKRHd
kCDo0DrQLiKmlKo8DkZozv9YFVxyoYESAfcxLhnKiaRT/RE6QLt85VUItPl8lEQh
1erCt74VG5UoIW+sE5Lz/xAjwPMK5XUwIZJJHEp/RVRqMzyxoqM0vIexS+CfFn0X
0Ayew3oEL4oguF4NJRb609I25tKFQU/b+AiTvA2DkiZ1hH5yk6kgg4VS21czCDJB
5UoZ8FgGdSP/PN8DQZ50X0A1x2VO83Pje5FhlEUKVs2eKbb48989RNCcYNwHy2lY
Ch3o4HzfS+Zhf2lgljoNJrj/rsSGanMFCmLcLZqQWaNN3I3suuDBr8IZJJiKP/SE
OyoV3lWFnQGhABEBAAHCwXwEGAEKACYWIQQuLi+Y9XBlZ2m6p2qW93DHObxazgUC
ZPW8XwIbDAUJAgIpAAAKCRCW93DHObxazqt5D/938SB3G2m5LzR5aYgBpn3C5arg
O3QO0JHsmzXXzCRZ0f8hPVZPNiuii3UwTX4v4eDcgi8MZnaEmxG0vQosal28Yd6f
jJdwNUv74K68N7xB5kAlwC/jONbAeSmod3EwUq8vKINseV/IzBux/uX3CBwvDpGi
a6v/h0EzuF5HQjguvu7/JSuVxP6y0aJ4gECmOJQMtppSlFBXzD5U6E2X6v6zHvqY
tkgwn00Y9J+V60+vncxAGfSJtcLOceAY2rEmj1bl8rhRCTcacImyh0HKfIST+v9o
Jx+opSyHo1RjhwcbmSoc3U5CGZx+y05H/WceQgett5qOZAGUDZhprTt+j/+scrAR
zZf0zzlpkao8UoergBMYc8iTmJ54/iQSxrk1WjS7OecP45oV7fwBNkQZeZuPITnD
0VP/RPpjd4Qz6eDWaccZPCrS785I0Onylygn5aOktDPU3eOmEhrHMuG+JSjfVqbi
m7jVqPFjWg3Loprmpwa1CGd2039Pa/jWfwh0bxsosSdf09kVj+UvlH4Y85Ve57LU
q9U+cpekCs/VZdL277tiMA2uFvQDSepwmQdBUYxkJSffVfK/cJhzZdY0FjsiVySl
kLVKxp9HzWMCMKaIqdXE+4STZz8/FAE8e3yuEbsXs/pmEtR0MZa8pBwmOvN5CSvG
u/zTgENjjv+UNmNeRA==
=IEGB
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE4I1aChuaH07AdH+adlTpHiRAJW0FAmWdXEsACgkQdlTpHiRA
JW0rbhAAtAtZz51JaUW6gCOnFRS+RgBZGgAPM0X9TQ/N5BaxRTD6w5c01KwgdgIe
FIzBaRZNes3YcgZiA8+RLxzpUeWaA62GkNWPmOiYsJpCHxTG7PHRMS+C09NM5+tv
yqMsKg1ZJ8klZmYACIGroYjyB4gWC0gl/XWeQrhXXB/AzDtbm4olJfb1kQ+/dwxY
IZ/WoM+Xi40U1TNOaQLBK5VZoTuX2Tr4dqGImgkaOQToOqgFz127AI3efoVo6UnD
WmXDH2l/BL/uk/UDH3jCtaOkvCd4xtgJK5bkYHYWnd83leXnUXprFjckAFTelYDO
qgbERC5Ng8EEb5pzfurgETuJ9ipQ0z/Vyn9/QNDLz0RfpqFR9psRRetsuOLIYBv3
jOXJi5OMzEeG32btUaK4Hpt6EshUesWJGHyjMoFdOwkdLIFGvaoQ6NGT8Q4CENUP
Y631boBt23x14pfC/GIyIcFeeqBqgprueX3nyalQ18cmLD8D8Sm5tubc7ysAZegz
7GS/4lo7DLOGD1dwwFKFxPGpYuRuh846M/1RQKDT3+f6QJVt2Vc4SHYBF+O9rvvr
9FnsuxIXKU5uZle55HdBolGs4FqV8VPtFx7OOU/2XTZuULHk+ox67DuhqiLNwrTK
VV+k9tpVUSQN1qLxVecmZIIn/MnzgV1kw+Jm+lnTN116HnC63y4=
=gS9V
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6038-2
January 09, 2024
golang-1.13, golang-1.16 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Go.
Software Description:
- golang-1.13: Go programming language compiler
- golang-1.16: Go programming language compiler
Details:
USN-6038-1 fixed several vulnerabilities in Go 1.18. This update provides
the corresponding updates for Go 1.13 and Go 1.16.
CVE-2022-29526 and CVE-2022-30630 only affected Go 1.16.
Original advisory details:
It was discovered that the Go net/http module incorrectly handled
Transfer-Encoding headers in the HTTP/1 client. A remote attacker could
possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-1705)
It was discovered that Go did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a panic
resulting into a denial of service. (CVE-2022-1962, CVE-2022-27664,
CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632,
CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715,
CVE-2022-41717, CVE-2023-24534, CVE-2023-24537)
It was discovered that Go did not properly implemented the maximum size of
file headers in Reader.Read. An attacker could possibly use this issue to
cause a panic resulting into a denial of service. (CVE-2022-2879)
It was discovered that the Go net/http module incorrectly handled query
parameters in requests forwarded by ReverseProxy. A remote attacker could
possibly use this issue to perform an HTTP Query Parameter Smuggling
attack.
(CVE-2022-2880)
It was discovered that Go did not properly manage the permissions for
Faccessat function. A attacker could possibly use this issue to expose
sensitive information. (CVE-2022-29526)
It was discovered that Go did not properly generate the values for
ticket_age_add in session tickets. An attacker could possibly use this
issue to observe TLS handshakes to correlate successive connections by
comparing ticket ages during session resumption. (CVE-2022-30629)
It was discovered that Go did not properly manage client IP addresses in
net/http. An attacker could possibly use this issue to cause ReverseProxy
to set the client IP as the value of the X-Forwarded-For header.
(CVE-2022-32148)
It was discovered that Go did not properly validate backticks (`) as
Javascript string delimiters, and do not escape them as expected. An
attacker could possibly use this issue to inject arbitrary Javascript code
into the Go template. (CVE-2023-24538)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
golang-1.13 1.13.8-1ubuntu2.22.04.2
golang-1.13-go 1.13.8-1ubuntu2.22.04.2
golang-1.13-src 1.13.8-1ubuntu2.22.04.2
Ubuntu 20.04 LTS:
golang-1.13 1.13.8-1ubuntu1.2
golang-1.13-go 1.13.8-1ubuntu1.2
golang-1.13-src 1.13.8-1ubuntu1.2
golang-1.16 1.16.2-0ubuntu1~20.04.1
golang-1.16-go 1.16.2-0ubuntu1~20.04.1
golang-1.16-src 1.16.2-0ubuntu1~20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
golang-1.13 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.13-go 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.13-src 1.13.8-1ubuntu1~18.04.4+esm1
golang-1.16 1.16.2-0ubuntu1~18.04.2+esm1
golang-1.16-go 1.16.2-0ubuntu1~18.04.2+esm1
golang-1.16-src 1.16.2-0ubuntu1~18.04.2+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
golang-1.13 1.13.8-1ubuntu1~16.04.3+esm3
golang-1.13-go 1.13.8-1ubuntu1~16.04.3+esm3
golang-1.13-src 1.13.8-1ubuntu1~16.04.3+esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6038-2
https://ubuntu.com/security/notices/USN-6038-1
CVE-2022-1705, CVE-2022-27664, CVE-2022-28131, CVE-2022-2879,
CVE-2022-2880, CVE-2022-29526, CVE-2022-30629, CVE-2022-30630,
CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30635,
CVE-2022-32148, CVE-2022-32189, CVE-2022-41717, CVE-2023-24534,
CVE-2023-24537, CVE-2023-24538
Package Information:
https://launchpad.net/ubuntu/+source/golang-1.13/1.13.8-1ubuntu2.22.04.2
https://launchpad.net/ubuntu/+source/golang-1.13/1.13.8-1ubuntu1.2
https://launchpad.net/ubuntu/+source/golang-1.16/1.16.2-0ubuntu1~20.04.1
No comments:
Post a Comment