Debian Security Advisory
DLA-2891-1 golang-1.8 -- LTS security update
- Date Reported:
- 21 Jan 2022
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 989492, Bug 991961.
In Mitre's CVE dictionary: CVE-2021-33196, CVE-2021-36221, CVE-2021-39293, CVE-2021-41771, CVE-2021-44716, CVE-2021-44717.
- More information:
Several vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial-of-service (DoS) and information leak.
In archive/zip, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
Go has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
Follow-up fix to CVE-2021-33196
ImportedSymbols in debug/macho (for Open or OpenFat) accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
net/http allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Go on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.
For Debian 9 stretch, these problems have been fixed in version 1.8.1-1+deb9u4.
We recommend that you upgrade your golang-1.8 packages.
For the detailed security status of golang-1.8 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/golang-1.8
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS