Synopsis

Important: go-toolset:rhel8 security and bug fix update

Type/Severity

Security Advisory: Important

Topic

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)
  
• HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• Failure trying to conntect to image registry using TLS when buildah is compiled with FIPS mode (BZ#1743169)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
• BZ - 1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
• BZ - 1743169 - Failure trying to conntect to image registry using TLS when buildah is compiled with FIPS mode [8.0.0.z]

CVEs

• CVE-2019-9512
• CVE-2019-9514

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for x86_64 8

SRPM
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: b40801bb2ebd794e53d4d9570e5e0aad7330ff1982c533f9187423aff000f0f1
golang-1.11.13-2.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: 84894c5de6bdc9b92adafdb2fbb4a62b32bcbc2129854d1ad8b3864a6934e51a
x86_64
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.x86_64.rpm	SHA-256: e4acd2603ff4db476efc391e16be282610082453d4d57f74e1b47d15a760aaa1
golang-1.11.13-2.module+el8.0.1+4087+d8180914.x86_64.rpm	SHA-256: b6f68dea3613287506c36e5da64dfcfb03f9d975e22ae9837f2329e077e468cd
golang-bin-1.11.13-2.module+el8.0.1+4087+d8180914.x86_64.rpm	SHA-256: 518463c646033ea9e5928a8e25251aa507f75a45fd4ee5671f6b0cbce0b1407b
golang-docs-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 5ee3a475d9011d73d0af39928cd60bf1d1cc593acfe00b7d3eb436e8de857563
golang-misc-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 31de6c97c1fe9e1cb59e308397aaea58f591875a7fd762e4d6fa870ad682c50e
golang-race-1.11.13-2.module+el8.0.1+4087+d8180914.x86_64.rpm	SHA-256: 8e437570df56ef530fa86fca1fb39639f24a395876ef0a0966d91bd22b277994
golang-src-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: ab1488fa584651f40a8579381fe4c180499ec152b37abb523ed637c556e2e8cd
golang-tests-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 21dd49269017eb9f0dd7e8b32ebea1abfa8acc604f3572689dcff1b9677fce51

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: b40801bb2ebd794e53d4d9570e5e0aad7330ff1982c533f9187423aff000f0f1
golang-1.11.13-2.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: 84894c5de6bdc9b92adafdb2fbb4a62b32bcbc2129854d1ad8b3864a6934e51a
s390x
golang-docs-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 5ee3a475d9011d73d0af39928cd60bf1d1cc593acfe00b7d3eb436e8de857563
golang-misc-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 31de6c97c1fe9e1cb59e308397aaea58f591875a7fd762e4d6fa870ad682c50e
golang-src-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: ab1488fa584651f40a8579381fe4c180499ec152b37abb523ed637c556e2e8cd
golang-tests-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 21dd49269017eb9f0dd7e8b32ebea1abfa8acc604f3572689dcff1b9677fce51
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.s390x.rpm	SHA-256: 4a9bf8fef5c757817359af2bfa1166785574d333bf6f7dd2e27d7c8d7c9b2e2c
golang-1.11.13-2.module+el8.0.1+4087+d8180914.s390x.rpm	SHA-256: 809c6e3ebceaea8c3a27231215391ae9efbeab3087894642849617c0c94f7657
golang-bin-1.11.13-2.module+el8.0.1+4087+d8180914.s390x.rpm	SHA-256: 101d7e7b2b4d551364e783a4e16690ebe68587899e4b7af0d36e24d391fe0fbd

Red Hat Enterprise Linux for Power, little endian 8

SRPM
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: b40801bb2ebd794e53d4d9570e5e0aad7330ff1982c533f9187423aff000f0f1
golang-1.11.13-2.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: 84894c5de6bdc9b92adafdb2fbb4a62b32bcbc2129854d1ad8b3864a6934e51a
ppc64le
golang-docs-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 5ee3a475d9011d73d0af39928cd60bf1d1cc593acfe00b7d3eb436e8de857563
golang-misc-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 31de6c97c1fe9e1cb59e308397aaea58f591875a7fd762e4d6fa870ad682c50e
golang-src-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: ab1488fa584651f40a8579381fe4c180499ec152b37abb523ed637c556e2e8cd
golang-tests-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 21dd49269017eb9f0dd7e8b32ebea1abfa8acc604f3572689dcff1b9677fce51
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.ppc64le.rpm	SHA-256: 432f27d31256a3b747159c7298454891f60ef0c111dcd2076b3072947c99e034
golang-1.11.13-2.module+el8.0.1+4087+d8180914.ppc64le.rpm	SHA-256: f3950c868e2648a578a1b0f0411e110b9ae1cbb5feef41202e9a774acc2c9af5
golang-bin-1.11.13-2.module+el8.0.1+4087+d8180914.ppc64le.rpm	SHA-256: 26996a69bf12e74ad7d4e389949335cdfd78a467ea1249b3643dcb428fc34b81

Red Hat Enterprise Linux for ARM 64 8

SRPM
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: b40801bb2ebd794e53d4d9570e5e0aad7330ff1982c533f9187423aff000f0f1
golang-1.11.13-2.module+el8.0.1+4087+d8180914.src.rpm	SHA-256: 84894c5de6bdc9b92adafdb2fbb4a62b32bcbc2129854d1ad8b3864a6934e51a
aarch64
golang-docs-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 5ee3a475d9011d73d0af39928cd60bf1d1cc593acfe00b7d3eb436e8de857563
golang-misc-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 31de6c97c1fe9e1cb59e308397aaea58f591875a7fd762e4d6fa870ad682c50e
golang-src-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: ab1488fa584651f40a8579381fe4c180499ec152b37abb523ed637c556e2e8cd
golang-tests-1.11.13-2.module+el8.0.1+4087+d8180914.noarch.rpm	SHA-256: 21dd49269017eb9f0dd7e8b32ebea1abfa8acc604f3572689dcff1b9677fce51
go-toolset-1.11.13-1.module+el8.0.1+4087+d8180914.aarch64.rpm	SHA-256: 97e53955e1f0706ee430faa83ca8d012b08440de89dbec359b99b546abe8a8aa
golang-1.11.13-2.module+el8.0.1+4087+d8180914.aarch64.rpm	SHA-256: 90fca2b6094983daee5c82be78a5f4d6468ee1efc7e5a256d5c1b71a2560e122
golang-bin-1.11.13-2.module+el8.0.1+4087+d8180914.aarch64.rpm	SHA-256: c737273da01201be83068ea466228f43fa10b02a56886d1e057e1b4308c7665a