[SECURITY] [DLA 2891-1] golang-1.8 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2891-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Sylvain Beucler
January 21, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : golang-1.8
Version : 1.8.1-1+deb9u4
CVE ID : CVE-2021-33196 CVE-2021-36221 CVE-2021-39293 CVE-2021-41771
CVE-2021-44716 CVE-2021-44717
Debian Bug : 989492 991961
Several vulnerabilities were discovered in the Go programming
language. An attacker could trigger a denial-of-service (DoS) and
information leak.
CVE-2021-33196
In archive/zip, a crafted file count (in an archive's header) can
cause a NewReader or OpenReader panic.
CVE-2021-36221
Go has a race condition that can lead to a net/http/httputil
ReverseProxy panic upon an ErrAbortHandler abort.
CVE-2021-39293
Follow-up fix to CVE-2021-33196
CVE-2021-41771
ImportedSymbols in debug/macho (for Open or OpenFat) accesses a
Memory Location After the End of a Buffer, aka an out-of-bounds
slice situation.
CVE-2021-44716
net/http allows uncontrolled memory consumption in the header
canonicalization cache via HTTP/2 requests.
CVE-2021-44717
Go on UNIX allows write operations to an unintended file or
unintended network connection as a consequence of erroneous
closing of file descriptor 0 after file-descriptor exhaustion.
For Debian 9 stretch, these problems have been fixed in version
1.8.1-1+deb9u4.
We recommend that you upgrade your golang-1.8 packages.
For the detailed security status of golang-1.8 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.8
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmHrLPcACgkQDTl9HeUl
XjCxehAAi/DryRxTK+P2RuSQbbjH7DCexcU6eWWtC5FiehnMhes+/caTPXQAInJK
Cko0hOk8qrnLrexsNtKYnhOw4OpKcemTbREA2UZpnQW1gDZUxHB2eP8PHXXFID5K
NEDLjScRsLne/Jrrpqo9GO7NIJv6g0clG6rQMSXuE/neC/89TLWcU/WiXTg0uviq
8Dly3ZBmkXY1fRA755Rf3QI+AXApxEqQCg77lMrkBZ7P+CYHdTCGmVsEhcSZ2AcI
DuzblIZdrpN+4FHUpYKdNWCqJ2n0W2SgqpRy/YGTs2sethxQ9rN/rkv3c6WLWmCU
sh3FMTGTXUI3aXwFbeoE0CMTvADUTJZUXwAELZMibB4LeNbmsFd8pSldgbp4o3Hf
TbVAT2++NC4LgW1wxwcv6SwAVmNidki8VmvPOAcf84bAYMDi2dRQbQP35aORfvie
BY6fYS2ViTMDxD6P3KkCtLjMtFq4hIJ6qfwKUGLw29t/rRlwyUTcLRfDyznEB8oU
1+xCV54+0YjH2K/yc6MTs3hg4+YsS5nsQldFz/1crg0G2v8v9IJSBh6tbtJ9JU0v
uTErUL0HTXWkd2URFftZ9Dy9ugXDSChSXiae5S49qlExNAOzkl5qs25LOWXsviuU
NR8W0zzin6HUe7VMWEkR98xGxMoiq6eF9UGCOEW8DKUltpU7V/Q=
=MUfr
-----END PGP SIGNATURE-----
Reply to: