Issued:
2021-05-18
Updated:
2021-05-18

RHSA-2021:1746 - Security Advisory

Synopsis

Moderate: go-toolset:rhel8 security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

The following packages have been upgraded to a later upstream version: golang (1.15.7), delve (1.5.0). (BZ#1870531)

Security Fix(es):

  • golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)
  • golang: cmd/go: packages using cgo can cause arbitrary code execution at build time (CVE-2021-3115)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1918750 - CVE-2021-3114 golang: crypto/elliptic: incorrect operations on the P-224 curve
  • BZ - 1918761 - CVE-2021-3115 golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

Red Hat Enterprise Linux for x86_64 8

SRPM
delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src.rpm SHA-256: 82330956b947a41b6641b4a58b476507d2aadb0fb314fb775c2a12bb8786733d
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: 39431961ecb31abd5bf6e2d8241c83cd535ab0dc3a9b3057787e7bbb67ffff50
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: a462dbe03e888956f2e6b0e81487fe615bcfb4e17d244f8c4e630fa19f4b15fa
x86_64
golang-docs-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 6990e64adff4615c23bbb43410f1db82156b321212ecb4a964d3fe42dafe2f25
golang-misc-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 51893e35b9ec4f27924510cd15265d3d1b8b78fa4cd80970b2727ebe9805f4be
golang-src-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: b495574f40bc9d1c26ae7748735ed20a3941c929ce689012273ff155b5cded0f
golang-tests-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 955e8c2921f843cc39650b00eabe17fd7f967d59185ee0f875cbb13864b6c950
delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64.rpm SHA-256: ea15304bd24355b219103aaf4c774ca82ec47b9def5f4bd2c38b125ad914fe8a
delve-debuginfo-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64.rpm SHA-256: 94e586cbd77e5cc8b98fda58a90d5ff365ddab1d155dd5f4e0ad4eac90e7ce1f
delve-debugsource-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64.rpm SHA-256: f654ab129b47aa437f717237ffc37c66a4716d81ac8575066939c76811eb0c6b
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.x86_64.rpm SHA-256: e5203746d35683201fa3e7f42b82125e42244cf55ae700a7c2a080cc850b08a5
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.x86_64.rpm SHA-256: 4966355405ae872fcc7dcbd397ffde960514d7e73e454a920455609d516a18b4
golang-bin-1.15.7-1.module+el8.4.0+9580+3b0e6c24.x86_64.rpm SHA-256: 6581c60fdff09014c667e8a0aa33cc48e4ee7f9ce8f6414b70c6f01e3d5d866a
golang-race-1.15.7-1.module+el8.4.0+9580+3b0e6c24.x86_64.rpm SHA-256: 8f706621384006d1a25b826460c6b4611e0c62bb1ffb9d7ed04c707ecbfe6144

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: 39431961ecb31abd5bf6e2d8241c83cd535ab0dc3a9b3057787e7bbb67ffff50
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: a462dbe03e888956f2e6b0e81487fe615bcfb4e17d244f8c4e630fa19f4b15fa
s390x
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.s390x.rpm SHA-256: ddc6a4c1d55cf968b4085f665052ee5482ba521e29751b8e0cb03921bea33fca
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.s390x.rpm SHA-256: e4449fc9bda2fda34bb36a197e7f4138e7e4e740a5caf59562afb27c7b3f2e4d
golang-bin-1.15.7-1.module+el8.4.0+9580+3b0e6c24.s390x.rpm SHA-256: 62af95be35c8c9148201adf6545f135b32924224db841f7aa13676a9af84073b
golang-docs-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 6990e64adff4615c23bbb43410f1db82156b321212ecb4a964d3fe42dafe2f25
golang-misc-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 51893e35b9ec4f27924510cd15265d3d1b8b78fa4cd80970b2727ebe9805f4be
golang-src-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: b495574f40bc9d1c26ae7748735ed20a3941c929ce689012273ff155b5cded0f
golang-tests-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 955e8c2921f843cc39650b00eabe17fd7f967d59185ee0f875cbb13864b6c950

Red Hat Enterprise Linux for Power, little endian 8

SRPM
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: 39431961ecb31abd5bf6e2d8241c83cd535ab0dc3a9b3057787e7bbb67ffff50
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: a462dbe03e888956f2e6b0e81487fe615bcfb4e17d244f8c4e630fa19f4b15fa
ppc64le
golang-docs-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 6990e64adff4615c23bbb43410f1db82156b321212ecb4a964d3fe42dafe2f25
golang-misc-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 51893e35b9ec4f27924510cd15265d3d1b8b78fa4cd80970b2727ebe9805f4be
golang-src-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: b495574f40bc9d1c26ae7748735ed20a3941c929ce689012273ff155b5cded0f
golang-tests-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 955e8c2921f843cc39650b00eabe17fd7f967d59185ee0f875cbb13864b6c950
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.ppc64le.rpm SHA-256: fd72bac053c1f97a7783f8783e9a8a6c1f3a51be08d1afad6d1770dc2b0d2657
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.ppc64le.rpm SHA-256: ca67d51e680543eb5445406c2336efa9465ceafa6b1692ad5ee87551144c7b98
golang-bin-1.15.7-1.module+el8.4.0+9580+3b0e6c24.ppc64le.rpm SHA-256: ce5ede803348c83484adc07351939b06e29d9203bbf9203ebccfbfae5ffe84c7

Red Hat Enterprise Linux for ARM 64 8

SRPM
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: 39431961ecb31abd5bf6e2d8241c83cd535ab0dc3a9b3057787e7bbb67ffff50
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.src.rpm SHA-256: a462dbe03e888956f2e6b0e81487fe615bcfb4e17d244f8c4e630fa19f4b15fa
aarch64
golang-docs-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 6990e64adff4615c23bbb43410f1db82156b321212ecb4a964d3fe42dafe2f25
golang-misc-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 51893e35b9ec4f27924510cd15265d3d1b8b78fa4cd80970b2727ebe9805f4be
golang-src-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: b495574f40bc9d1c26ae7748735ed20a3941c929ce689012273ff155b5cded0f
golang-tests-1.15.7-1.module+el8.4.0+9580+3b0e6c24.noarch.rpm SHA-256: 955e8c2921f843cc39650b00eabe17fd7f967d59185ee0f875cbb13864b6c950
go-toolset-1.15.7-1.module+el8.4.0+9580+3b0e6c24.aarch64.rpm SHA-256: 0c8bcc57b7472aef8b505229883298c6cfd67043f19073bed80b79b33e83cc5a
golang-1.15.7-1.module+el8.4.0+9580+3b0e6c24.aarch64.rpm SHA-256: 1e7362b3f86e009f4e169f916405a085a80be5cef56b56b60a7e360f3b3811c2
golang-bin-1.15.7-1.module+el8.4.0+9580+3b0e6c24.aarch64.rpm SHA-256: bea42404d225e98700dc5f85811847bc67b60c518f6e960734f5fd1dac760306

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.