Synopsis

Moderate: go-toolset-7 and go-toolset-7-golang security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

An update for go-toolset-7 and go-toolset-7-golang is now available for Red Hat Developer Tools.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side. (CVE-2017-15041)
  
• It was found that smtp.PlainAuth authentication scheme in Go did not verify the TLS requirement properly. A remote man-in-the-middle attacker could potentially use this flaw to sniff SMTP credentials sent by a Go application. (CVE-2017-15042)
  

Bug Fix(es):

• Previously, the enable script for the go-toolset-7 Software Collection incorrectly set the GOPATH environment variable to a directory that required root permissions for write operations. As a consequence, the go compiler terminated unexpectedly when performing certain commands. The enable script has been changed to handle GOPATH correctly, and the described problem no longer occurs. (BZ#1512013)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Developer Tools (for RHEL Workstation) 1 x86_64
• Red Hat Developer Tools (for RHEL Server) 1 x86_64
• Red Hat Developer Tools (for RHEL Server for System Z) 1 s390x
• Red Hat Developer Tools (for RHEL Server for IBM Power LE) 1 ppc64le
• Red Hat Developer Tools (for RHEL Server for ARM) 1 aarch64

Fixes

• BZ - 1498867 - CVE-2017-15042 golang: smtp.PlainAuth susceptible to man-in-the-middle password harvesting
• BZ - 1498870 - CVE-2017-15041 golang: arbitrary code execution during "go get" or "go get -d"

CVEs

• CVE-2017-15041
• CVE-2017-15042

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Developer Tools (for RHEL Workstation) 1

SRPM
go-toolset-7-1.8-10.el7.src.rpm	SHA-256: b75e58208b24263af0c0501e9fb3c01e9c74d3bb256ff6408ec84923582574ff
go-toolset-7-golang-1.8.5-1.el7.src.rpm	SHA-256: ef96d7518debae4c394b3fbc8c00a07c74aabb8669b2c635b864676b7d43b1d7
x86_64
go-toolset-7-1.8-10.el7.x86_64.rpm	SHA-256: 2f3218a8c977e85956d5630d2bca24ad6477bfd95baa0724d86721f58b513c60
go-toolset-7-build-1.8-10.el7.x86_64.rpm	SHA-256: 1878bea550a229d5d8e02ad84d42a36a5b6c84c58651496de57ad4e9fac77d7d
go-toolset-7-dockerfiles-1.8-10.el7.x86_64.rpm	SHA-256: 6f071159ac41202d3b2751e5d2bff6e15469b31b336a415a0d757c9edd163391
go-toolset-7-golang-1.8.5-1.el7.x86_64.rpm	SHA-256: d582646f90734e32a74c679e3a136b0df5e707421bc24420f7bebb2bdf4bb709
go-toolset-7-golang-bin-1.8.5-1.el7.x86_64.rpm	SHA-256: 35ce543b537765cd1c81459875f931e9b87be5b035c0b68e3db27221d28fbdbe
go-toolset-7-golang-docs-1.8.5-1.el7.noarch.rpm	SHA-256: bf10b928e6ebfd7870a3aa1f1de1dc5d429b09da45b37d363ddf0894207c7217
go-toolset-7-golang-misc-1.8.5-1.el7.noarch.rpm	SHA-256: bf78d4a4d955ba3d88f20095152c15c3da243bf8f9f2713889cd03621a0de544
go-toolset-7-golang-race-1.8.5-1.el7.x86_64.rpm	SHA-256: ce4233ffa3fb553388198c9898d0d8500f72d24f9dfc94d7ae5876e2493105c6
go-toolset-7-golang-src-1.8.5-1.el7.noarch.rpm	SHA-256: ccd471681aed10bc612228bdab228232392dafb5d0ee383d049b3347c519294a
go-toolset-7-golang-tests-1.8.5-1.el7.noarch.rpm	SHA-256: e921e79f81cbee038ed3bf0b40ae53acde8c3f00313c41993b955af56638a09a
go-toolset-7-runtime-1.8-10.el7.x86_64.rpm	SHA-256: 342018dc7f2a0889290424fdac31f01a9a05689dfa5da4fdfb37074c7f3e2b09
go-toolset-7-scldevel-1.8-10.el7.x86_64.rpm	SHA-256: 5e6a2f43f11c050e6a32c1b3ea5dfbda7775da0d6e60dee61e5079db38a31065

Red Hat Developer Tools (for RHEL Server) 1

SRPM
go-toolset-7-1.8-10.el7.src.rpm	SHA-256: b75e58208b24263af0c0501e9fb3c01e9c74d3bb256ff6408ec84923582574ff
go-toolset-7-golang-1.8.5-1.el7.src.rpm	SHA-256: ef96d7518debae4c394b3fbc8c00a07c74aabb8669b2c635b864676b7d43b1d7
x86_64
go-toolset-7-1.8-10.el7.x86_64.rpm	SHA-256: 2f3218a8c977e85956d5630d2bca24ad6477bfd95baa0724d86721f58b513c60
go-toolset-7-build-1.8-10.el7.x86_64.rpm	SHA-256: 1878bea550a229d5d8e02ad84d42a36a5b6c84c58651496de57ad4e9fac77d7d
go-toolset-7-dockerfiles-1.8-10.el7.x86_64.rpm	SHA-256: 6f071159ac41202d3b2751e5d2bff6e15469b31b336a415a0d757c9edd163391
go-toolset-7-golang-1.8.5-1.el7.x86_64.rpm	SHA-256: d582646f90734e32a74c679e3a136b0df5e707421bc24420f7bebb2bdf4bb709
go-toolset-7-golang-bin-1.8.5-1.el7.x86_64.rpm	SHA-256: 35ce543b537765cd1c81459875f931e9b87be5b035c0b68e3db27221d28fbdbe
go-toolset-7-golang-docs-1.8.5-1.el7.noarch.rpm	SHA-256: bf10b928e6ebfd7870a3aa1f1de1dc5d429b09da45b37d363ddf0894207c7217
go-toolset-7-golang-misc-1.8.5-1.el7.noarch.rpm	SHA-256: bf78d4a4d955ba3d88f20095152c15c3da243bf8f9f2713889cd03621a0de544
go-toolset-7-golang-race-1.8.5-1.el7.x86_64.rpm	SHA-256: ce4233ffa3fb553388198c9898d0d8500f72d24f9dfc94d7ae5876e2493105c6
go-toolset-7-golang-src-1.8.5-1.el7.noarch.rpm	SHA-256: ccd471681aed10bc612228bdab228232392dafb5d0ee383d049b3347c519294a
go-toolset-7-golang-tests-1.8.5-1.el7.noarch.rpm	SHA-256: e921e79f81cbee038ed3bf0b40ae53acde8c3f00313c41993b955af56638a09a
go-toolset-7-runtime-1.8-10.el7.x86_64.rpm	SHA-256: 342018dc7f2a0889290424fdac31f01a9a05689dfa5da4fdfb37074c7f3e2b09
go-toolset-7-scldevel-1.8-10.el7.x86_64.rpm	SHA-256: 5e6a2f43f11c050e6a32c1b3ea5dfbda7775da0d6e60dee61e5079db38a31065

Red Hat Developer Tools (for RHEL Server for System Z) 1

SRPM
go-toolset-7-1.8-10.el7.src.rpm	SHA-256: b75e58208b24263af0c0501e9fb3c01e9c74d3bb256ff6408ec84923582574ff
go-toolset-7-golang-1.8.5-1.el7.src.rpm	SHA-256: ef96d7518debae4c394b3fbc8c00a07c74aabb8669b2c635b864676b7d43b1d7
s390x
go-toolset-7-1.8-10.el7.s390x.rpm	SHA-256: f3a8a28421c0fa0c7172838984718c25edbfa764dbb112f5fa337306e01949fd
go-toolset-7-build-1.8-10.el7.s390x.rpm	SHA-256: db908eb961d1d67057ebdc8d6a520b5b09d342153a3e8cac0903efeb67d94959
go-toolset-7-dockerfiles-1.8-10.el7.s390x.rpm	SHA-256: 1e42307948f6c3e6496ed6a0ca5e9f8e59a524603b22c06ad54d3531e84c27c5
go-toolset-7-golang-1.8.5-1.el7.s390x.rpm	SHA-256: ff4cf7e5fcf86768b7110d93d30bcc0229aa06d77052ecb7aedb530a1bf1984d
go-toolset-7-golang-bin-1.8.5-1.el7.s390x.rpm	SHA-256: 85c465c12c5f477a09ff426b6efa26dd962ded2a52add2d92e3f53304f637f28
go-toolset-7-golang-docs-1.8.5-1.el7.noarch.rpm	SHA-256: bf10b928e6ebfd7870a3aa1f1de1dc5d429b09da45b37d363ddf0894207c7217
go-toolset-7-golang-misc-1.8.5-1.el7.noarch.rpm	SHA-256: bf78d4a4d955ba3d88f20095152c15c3da243bf8f9f2713889cd03621a0de544
go-toolset-7-golang-src-1.8.5-1.el7.noarch.rpm	SHA-256: ccd471681aed10bc612228bdab228232392dafb5d0ee383d049b3347c519294a
go-toolset-7-golang-tests-1.8.5-1.el7.noarch.rpm	SHA-256: e921e79f81cbee038ed3bf0b40ae53acde8c3f00313c41993b955af56638a09a
go-toolset-7-runtime-1.8-10.el7.s390x.rpm	SHA-256: 97d344aab70f9796635c7ac811b217b436e76dcae6d6992e758a5342a66e2b5f
go-toolset-7-scldevel-1.8-10.el7.s390x.rpm	SHA-256: acf85a73948a9dd303489e5d7d78b29504e219243a3feee782c97b45e19c0b7c

Red Hat Developer Tools (for RHEL Server for IBM Power LE) 1

SRPM
go-toolset-7-1.8-10.el7.src.rpm	SHA-256: b75e58208b24263af0c0501e9fb3c01e9c74d3bb256ff6408ec84923582574ff
go-toolset-7-golang-1.8.5-1.el7.src.rpm	SHA-256: ef96d7518debae4c394b3fbc8c00a07c74aabb8669b2c635b864676b7d43b1d7
ppc64le
go-toolset-7-1.8-10.el7.ppc64le.rpm	SHA-256: 00f5623445081540adbf6a55df84a8dddb694508656548be6612d92bdb13d9f3
go-toolset-7-1.8-10.el7.ppc64le.rpm	SHA-256: 00f5623445081540adbf6a55df84a8dddb694508656548be6612d92bdb13d9f3
go-toolset-7-build-1.8-10.el7.ppc64le.rpm	SHA-256: 9d1c67240e6784921b00ab86286264aeffa6d21de223af4fb2360557b6cc0e3d
go-toolset-7-build-1.8-10.el7.ppc64le.rpm	SHA-256: 9d1c67240e6784921b00ab86286264aeffa6d21de223af4fb2360557b6cc0e3d
go-toolset-7-dockerfiles-1.8-10.el7.ppc64le.rpm	SHA-256: e6cc1c5f65085ad12cb77c97796997576e9ec591179c7658de4ab7a70edf8a4a
go-toolset-7-dockerfiles-1.8-10.el7.ppc64le.rpm	SHA-256: e6cc1c5f65085ad12cb77c97796997576e9ec591179c7658de4ab7a70edf8a4a
go-toolset-7-golang-1.8.5-1.el7.ppc64le.rpm	SHA-256: 8ce3e8efaa6ffa66037d7071cec8a8bb35b94266d0cfc9fc05e3d0fa17400c66
go-toolset-7-golang-1.8.5-1.el7.ppc64le.rpm	SHA-256: 8ce3e8efaa6ffa66037d7071cec8a8bb35b94266d0cfc9fc05e3d0fa17400c66
go-toolset-7-golang-bin-1.8.5-1.el7.ppc64le.rpm	SHA-256: 6f859e2d39840174edec058431832ba66ce7645651a1175c7d9f7c9c37984f3a
go-toolset-7-golang-bin-1.8.5-1.el7.ppc64le.rpm	SHA-256: 6f859e2d39840174edec058431832ba66ce7645651a1175c7d9f7c9c37984f3a
go-toolset-7-golang-docs-1.8.5-1.el7.noarch.rpm	SHA-256: bf10b928e6ebfd7870a3aa1f1de1dc5d429b09da45b37d363ddf0894207c7217
go-toolset-7-golang-docs-1.8.5-1.el7.noarch.rpm	SHA-256: bf10b928e6ebfd7870a3aa1f1de1dc5d429b09da45b37d363ddf0894207c7217
go-toolset-7-golang-misc-1.8.5-1.el7.noarch.rpm	SHA-256: bf78d4a4d955ba3d88f20095152c15c3da243bf8f9f2713889cd03621a0de544
go-toolset-7-golang-misc-1.8.5-1.el7.noarch.rpm	SHA-256: bf78d4a4d955ba3d88f20095152c15c3da243bf8f9f2713889cd03621a0de544
go-toolset-7-golang-src-1.8.5-1.el7.noarch.rpm	SHA-256: ccd471681aed10bc612228bdab228232392dafb5d0ee383d049b3347c519294a
go-toolset-7-golang-src-1.8.5-1.el7.noarch.rpm	SHA-256: ccd471681aed10bc612228bdab228232392dafb5d0ee383d049b3347c519294a
go-toolset-7-golang-tests-1.8.5-1.el7.noarch.rpm	SHA-256: e921e79f81cbee038ed3bf0b40ae53acde8c3f00313c41993b955af56638a09a
go-toolset-7-golang-tests-1.8.5-1.el7.noarch.rpm	SHA-256: e921e79f81cbee038ed3bf0b40ae53acde8c3f00313c41993b955af56638a09a
go-toolset-7-runtime-1.8-10.el7.ppc64le.rpm	SHA-256: 846e0e697f0221e08407cf1fdcaabadd8fdc4ae1f382b35aa92d854f50369b66
go-toolset-7-runtime-1.8-10.el7.ppc64le.rpm	SHA-256: 846e0e697f0221e08407cf1fdcaabadd8fdc4ae1f382b35aa92d854f50369b66
go-toolset-7-scldevel-1.8-10.el7.ppc64le.rpm	SHA-256: c772bc46e4d1d87e879bd6c5a9310079ce9aef7c48fda7a6ac031b9e4100a54d
go-toolset-7-scldevel-1.8-10.el7.ppc64le.rpm	SHA-256: c772bc46e4d1d87e879bd6c5a9310079ce9aef7c48fda7a6ac031b9e4100a54d

Red Hat Developer Tools (for RHEL Server for ARM) 1

SRPM
go-toolset-7-1.8-10.el7.src.rpm	SHA-256: b75e58208b24263af0c0501e9fb3c01e9c74d3bb256ff6408ec84923582574ff
go-toolset-7-golang-1.8.5-1.el7.src.rpm	SHA-256: ef96d7518debae4c394b3fbc8c00a07c74aabb8669b2c635b864676b7d43b1d7
aarch64
go-toolset-7-1.8-10.el7.aarch64.rpm	SHA-256: b3f2a6b55099a03fe711c68a477f9a2fb0e9864fb97d0089d895703bf15ff0a4
go-toolset-7-build-1.8-10.el7.aarch64.rpm	SHA-256: 25e3b05718ee8ac24121cf5583e06dc11ac65798fbd818be64d64749a83e0ecd
go-toolset-7-dockerfiles-1.8-10.el7.aarch64.rpm	SHA-256: c251a99b35d0eddf56941c50e8fa4811f5502f5a1f66bb6a00526d0124b33443
go-toolset-7-golang-1.8.5-1.el7.aarch64.rpm	SHA-256: cbc571a5e639b3b2af16c967943e7a56b7fb0771c8c1c17fc2a288e4eca303f2
go-toolset-7-golang-bin-1.8.5-1.el7.aarch64.rpm	SHA-256: 62275b760304863984dcc45861c4709678a9746996999f07f30681896ca6da6c
go-toolset-7-golang-docs-1.8.5-1.el7.noarch.rpm	SHA-256: bf10b928e6ebfd7870a3aa1f1de1dc5d429b09da45b37d363ddf0894207c7217
go-toolset-7-golang-misc-1.8.5-1.el7.noarch.rpm	SHA-256: bf78d4a4d955ba3d88f20095152c15c3da243bf8f9f2713889cd03621a0de544
go-toolset-7-golang-src-1.8.5-1.el7.noarch.rpm	SHA-256: ccd471681aed10bc612228bdab228232392dafb5d0ee383d049b3347c519294a
go-toolset-7-golang-tests-1.8.5-1.el7.noarch.rpm	SHA-256: e921e79f81cbee038ed3bf0b40ae53acde8c3f00313c41993b955af56638a09a
go-toolset-7-runtime-1.8-10.el7.aarch64.rpm	SHA-256: 5dd1cd45f37b676d7991a70be8c9d9f159cfb5b7ca301e83cd4e22b8f688d27c
go-toolset-7-scldevel-1.8-10.el7.aarch64.rpm	SHA-256: 3254cad9fb9410e971e1e1272beb446b998d86f05d687cab4a55ab82c59e0f4b