Issued:
2020-02-04
Updated:
2020-02-04

RHSA-2020:0329 - Security Advisory

Synopsis

Moderate: go-toolset:rhel8 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling (CVE-2019-16276)
  • golang: invalid public key causes panic in dsa.Verify (CVE-2019-17596)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
  • Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Fixes

  • BZ - 1755969 - CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
  • BZ - 1763310 - CVE-2019-17596 golang: invalid public key causes panic in dsa.Verify

Red Hat Enterprise Linux for x86_64 8

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
x86_64
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: 6dcb3959276f562a254794bbd79f1a3f6064fd7c818ef61775d6954b9a892b9d
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: fa7737966b26cd71f6a24712f6798f4f277aa644dfe31bec1e748f9169ab6159
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: a3e08122715bcf09513666a444f197deb073d13aa4b491bd5519a3ea05d1afb9
golang-race-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: 7debc9db6a7041387b6e89258dec50cf5b5268c4eda4cba3771ab0162b1741a2

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
x86_64
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: 6dcb3959276f562a254794bbd79f1a3f6064fd7c818ef61775d6954b9a892b9d
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: fa7737966b26cd71f6a24712f6798f4f277aa644dfe31bec1e748f9169ab6159
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: a3e08122715bcf09513666a444f197deb073d13aa4b491bd5519a3ea05d1afb9
golang-race-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: 7debc9db6a7041387b6e89258dec50cf5b5268c4eda4cba3771ab0162b1741a2

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
s390x
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.s390x.rpm SHA-256: 37eb060c6e45b5758c54e3c2e1e0bcfc1ee2718a4f832c34a2973639db316f4d
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.s390x.rpm SHA-256: c9a6bb1328ebafd8893df7fa52d288f77776e28bfe8b4052c6dd3fa3caaada37
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.s390x.rpm SHA-256: d4093f02f569681cf86e6ad0733d2610a508c5b1cc1e75d0bce01f29de0fcda8
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
s390x
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.s390x.rpm SHA-256: 37eb060c6e45b5758c54e3c2e1e0bcfc1ee2718a4f832c34a2973639db316f4d
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.s390x.rpm SHA-256: c9a6bb1328ebafd8893df7fa52d288f77776e28bfe8b4052c6dd3fa3caaada37
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.s390x.rpm SHA-256: d4093f02f569681cf86e6ad0733d2610a508c5b1cc1e75d0bce01f29de0fcda8
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4

Red Hat Enterprise Linux for Power, little endian 8

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
ppc64le
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: 3c38c91a626650a36e74620fc6be312327ab2c56773b64df908913f4171a9d77
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: b28118a1e6fd4b5277fdc84a395562724ed13fda449056ea65b22b021b582d9d
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: 41ba79d63746b1650bc4822d3e6951e680da0ff5d13a1f9fe345875a17bb1b54

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
ppc64le
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: 3c38c91a626650a36e74620fc6be312327ab2c56773b64df908913f4171a9d77
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: b28118a1e6fd4b5277fdc84a395562724ed13fda449056ea65b22b021b582d9d
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: 41ba79d63746b1650bc4822d3e6951e680da0ff5d13a1f9fe345875a17bb1b54

Red Hat Enterprise Linux for ARM 64 8

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
aarch64
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.aarch64.rpm SHA-256: 2cdbec916e61d3e8af45d5a0acfa46cf5d3d66fb44599bf51d4dac7721aaf82d
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.aarch64.rpm SHA-256: e122d6c20e026057bc8fe42dc07992c3da7d327261c3712a631a9786545262e9
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.aarch64.rpm SHA-256: 142d47bafb9f80c06f3bc349af8c189aa63067fd085639acd52f499eb709957b

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
aarch64
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.aarch64.rpm SHA-256: 2cdbec916e61d3e8af45d5a0acfa46cf5d3d66fb44599bf51d4dac7721aaf82d
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.aarch64.rpm SHA-256: e122d6c20e026057bc8fe42dc07992c3da7d327261c3712a631a9786545262e9
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.aarch64.rpm SHA-256: 142d47bafb9f80c06f3bc349af8c189aa63067fd085639acd52f499eb709957b

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
ppc64le
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: 3c38c91a626650a36e74620fc6be312327ab2c56773b64df908913f4171a9d77
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: b28118a1e6fd4b5277fdc84a395562724ed13fda449056ea65b22b021b582d9d
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.ppc64le.rpm SHA-256: 41ba79d63746b1650bc4822d3e6951e680da0ff5d13a1f9fe345875a17bb1b54

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1

SRPM
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: ea7cab3c8359b004ffbaf004965978713ac3dc212abc83d713f7efc0f1102271
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.src.rpm SHA-256: 343d419d524cc2a51203864ae1fc7c45c53fabf2ae332e83a125171f119f6ecd
x86_64
golang-docs-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 2532000eaab1499b5eb3a44c276215f87f546ba5199445694c1019dbab602125
golang-misc-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 8946f8faf6f55c92edcbbc4b933f9d02974670d8fda7d5fd598e4c71824c610d
golang-src-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: 5c06cf480772c0c70fa368f3f3a9448ac5f672de681389001885b763d1e97634
golang-tests-1.12.12-4.module+el8.1.0+5317+8a49ffbb.noarch.rpm SHA-256: c175033b66d6ffd538067f3edd2a8889d132d665849209845d1be8171d5a36e4
go-toolset-1.12.12-2.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: 6dcb3959276f562a254794bbd79f1a3f6064fd7c818ef61775d6954b9a892b9d
golang-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: fa7737966b26cd71f6a24712f6798f4f277aa644dfe31bec1e748f9169ab6159
golang-bin-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: a3e08122715bcf09513666a444f197deb073d13aa4b491bd5519a3ea05d1afb9
golang-race-1.12.12-4.module+el8.1.0+5317+8a49ffbb.x86_64.rpm SHA-256: 7debc9db6a7041387b6e89258dec50cf5b5268c4eda4cba3771ab0162b1741a2

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.