Red Hat Product Errata RHSA-2023:0445 - Security Advisory
Issued:
2023-01-25
Updated:
2023-01-25

RHSA-2023:0445 - Security Advisory

Synopsis

Moderate: go-toolset-1.18 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for go-toolset-1.18 and go-toolset-1.18-golang is now available for Red Hat Developer Tools.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

  • golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
  • golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
  • golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • crypto testcases fail on golang on s390x [devtools-2022.4] (BZ#2149315)
  • Internal linking fails on ppc64le [devtools-2022.4] (BZ#2161298)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Developer Tools (for RHEL Workstation) 1 x86_64
  • Red Hat Developer Tools (for RHEL Server) 1 x86_64
  • Red Hat Developer Tools (for RHEL Server for System Z) 1 s390x
  • Red Hat Developer Tools (for RHEL Server for IBM Power LE) 1 ppc64le

Fixes

  • BZ - 2132867 - CVE-2022-2879 golang: archive/tar: unbounded memory consumption when reading headers
  • BZ - 2132868 - CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
  • BZ - 2132872 - CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
  • BZ - 2137549 - patch version mismatch between 'go version', go-toolset and golang packages [devtools-2022.4]
  • BZ - 2149315 - crypto testcases fail on golang on s390x [devtools-2022.4]

Red Hat Developer Tools (for RHEL Workstation) 1

SRPM
go-toolset-1.18-1.18.9-1.el7_9.src.rpm SHA-256: 0828040ec0ac4f1a594ac0fca28f51d0397520d2e4d0bb6edc1b8e990b140139
go-toolset-1.18-golang-1.18.9-1.el7_9.src.rpm SHA-256: 82f2dfa77522b6613bce050488d67a9957376ed8f11b5e00b14637b5cec2e3de
x86_64
go-toolset-1.18-1.18.9-1.el7_9.x86_64.rpm SHA-256: adf524ed49b738d4ae4c053c32c9da44cd0e0390ce203c1909b450f3c121c3a4
go-toolset-1.18-build-1.18.9-1.el7_9.x86_64.rpm SHA-256: 9c563fec037b7fdf12e896f7f109fbddd1f922c6b76af9ee049571f547a5adf3
go-toolset-1.18-golang-1.18.9-1.el7_9.x86_64.rpm SHA-256: 9244b4629fafe33965440da51959debcb90fea032909016df45e45a0328f90a1
go-toolset-1.18-golang-bin-1.18.9-1.el7_9.x86_64.rpm SHA-256: bb55122ab213d531114452f7219d1b456a9e419c52b12e48844ba7608967f90a
go-toolset-1.18-golang-docs-1.18.9-1.el7_9.noarch.rpm SHA-256: c61ed95639a77f7ba28ad98c37017696dae7d91e591773d243e8b23c5cf05752
go-toolset-1.18-golang-misc-1.18.9-1.el7_9.x86_64.rpm SHA-256: 3e1d0fb8258ca72a9469d37c44fd5691debd14dd1a1cc3ee444c16b22f6412e6
go-toolset-1.18-golang-race-1.18.9-1.el7_9.x86_64.rpm SHA-256: 502ff0606763692783e8f36b5eb63cd5f68deb567c987427133879cfc368b87e
go-toolset-1.18-golang-src-1.18.9-1.el7_9.x86_64.rpm SHA-256: 4123260b87ea4863bb65b2634ae0d95509d509e925db3bb9fe48855e2ce8b092
go-toolset-1.18-golang-tests-1.18.9-1.el7_9.x86_64.rpm SHA-256: 37fc8045720bf2f5358fc48b66b309343cdbcc30c4f7c170185843e9470bb275
go-toolset-1.18-runtime-1.18.9-1.el7_9.x86_64.rpm SHA-256: d4b376b5d8bfe886b99f86af467d04ce6978dc7115b7bd00ecc227b404a0a13b
go-toolset-1.18-scldevel-1.18.9-1.el7_9.x86_64.rpm SHA-256: 2aea903d15816a9398011b4a9612182f2b6b9fdba56332751e8709b7bd163429

Red Hat Developer Tools (for RHEL Server) 1

SRPM
go-toolset-1.18-1.18.9-1.el7_9.src.rpm SHA-256: 0828040ec0ac4f1a594ac0fca28f51d0397520d2e4d0bb6edc1b8e990b140139
go-toolset-1.18-golang-1.18.9-1.el7_9.src.rpm SHA-256: 82f2dfa77522b6613bce050488d67a9957376ed8f11b5e00b14637b5cec2e3de
x86_64
go-toolset-1.18-1.18.9-1.el7_9.x86_64.rpm SHA-256: adf524ed49b738d4ae4c053c32c9da44cd0e0390ce203c1909b450f3c121c3a4
go-toolset-1.18-build-1.18.9-1.el7_9.x86_64.rpm SHA-256: 9c563fec037b7fdf12e896f7f109fbddd1f922c6b76af9ee049571f547a5adf3
go-toolset-1.18-golang-1.18.9-1.el7_9.x86_64.rpm SHA-256: 9244b4629fafe33965440da51959debcb90fea032909016df45e45a0328f90a1
go-toolset-1.18-golang-bin-1.18.9-1.el7_9.x86_64.rpm SHA-256: bb55122ab213d531114452f7219d1b456a9e419c52b12e48844ba7608967f90a
go-toolset-1.18-golang-docs-1.18.9-1.el7_9.noarch.rpm SHA-256: c61ed95639a77f7ba28ad98c37017696dae7d91e591773d243e8b23c5cf05752
go-toolset-1.18-golang-misc-1.18.9-1.el7_9.x86_64.rpm SHA-256: 3e1d0fb8258ca72a9469d37c44fd5691debd14dd1a1cc3ee444c16b22f6412e6
go-toolset-1.18-golang-race-1.18.9-1.el7_9.x86_64.rpm SHA-256: 502ff0606763692783e8f36b5eb63cd5f68deb567c987427133879cfc368b87e
go-toolset-1.18-golang-src-1.18.9-1.el7_9.x86_64.rpm SHA-256: 4123260b87ea4863bb65b2634ae0d95509d509e925db3bb9fe48855e2ce8b092
go-toolset-1.18-golang-tests-1.18.9-1.el7_9.x86_64.rpm SHA-256: 37fc8045720bf2f5358fc48b66b309343cdbcc30c4f7c170185843e9470bb275
go-toolset-1.18-runtime-1.18.9-1.el7_9.x86_64.rpm SHA-256: d4b376b5d8bfe886b99f86af467d04ce6978dc7115b7bd00ecc227b404a0a13b
go-toolset-1.18-scldevel-1.18.9-1.el7_9.x86_64.rpm SHA-256: 2aea903d15816a9398011b4a9612182f2b6b9fdba56332751e8709b7bd163429

Red Hat Developer Tools (for RHEL Server for System Z) 1

SRPM
go-toolset-1.18-1.18.9-1.el7_9.src.rpm SHA-256: 0828040ec0ac4f1a594ac0fca28f51d0397520d2e4d0bb6edc1b8e990b140139
go-toolset-1.18-golang-1.18.9-1.el7_9.src.rpm SHA-256: 82f2dfa77522b6613bce050488d67a9957376ed8f11b5e00b14637b5cec2e3de
s390x
go-toolset-1.18-1.18.9-1.el7_9.s390x.rpm SHA-256: 6eab90f1bb26f429cd1265952331de899e963068bb36e66811e7027d95302bd0
go-toolset-1.18-build-1.18.9-1.el7_9.s390x.rpm SHA-256: 1cf1e41918654a5e8defcca28a6d8fa086007a9961c26837b98755c793334f55
go-toolset-1.18-golang-1.18.9-1.el7_9.s390x.rpm SHA-256: d52acd509056670a63038adff53eea4357838f019feb80aa800bd30952b74657
go-toolset-1.18-golang-bin-1.18.9-1.el7_9.s390x.rpm SHA-256: 7de167652c6a843756bdd422e68830c824ddfc05a569a45a7c4570bc0fb83d32
go-toolset-1.18-golang-docs-1.18.9-1.el7_9.noarch.rpm SHA-256: c61ed95639a77f7ba28ad98c37017696dae7d91e591773d243e8b23c5cf05752
go-toolset-1.18-golang-misc-1.18.9-1.el7_9.s390x.rpm SHA-256: 987601d7958692daaa20b2ee5ad59882d8b6faa2df567cc990d337499662cecf
go-toolset-1.18-golang-src-1.18.9-1.el7_9.s390x.rpm SHA-256: d8bd0fe525cfa24e314456a12b109bb5bcd63f1c12162d925bb1fe88bf45e2b0
go-toolset-1.18-golang-tests-1.18.9-1.el7_9.s390x.rpm SHA-256: 2cb56acd2263cb358d0f142bf0238752a11d8643aa61aef902d02613ce16f268
go-toolset-1.18-runtime-1.18.9-1.el7_9.s390x.rpm SHA-256: d0d42b4e47992db7a035b6f8f28ea5cdb04fa63af14d4ba155ac997071f717bd
go-toolset-1.18-scldevel-1.18.9-1.el7_9.s390x.rpm SHA-256: 879ffa0a777635ffa525980d47b8195bd33f7414471779db6787d22a88e20750

Red Hat Developer Tools (for RHEL Server for IBM Power LE) 1

SRPM
go-toolset-1.18-1.18.9-1.el7_9.src.rpm SHA-256: 0828040ec0ac4f1a594ac0fca28f51d0397520d2e4d0bb6edc1b8e990b140139
go-toolset-1.18-golang-1.18.9-1.el7_9.src.rpm SHA-256: 82f2dfa77522b6613bce050488d67a9957376ed8f11b5e00b14637b5cec2e3de
ppc64le
go-toolset-1.18-1.18.9-1.el7_9.ppc64le.rpm SHA-256: ee9583dc3bb8fe9ac17d1b87c586af6f761e69dc32ae40a3fcbc58600e483a87
go-toolset-1.18-build-1.18.9-1.el7_9.ppc64le.rpm SHA-256: 85fe28b1ab6640c720a752ddbc081e08641ce35cc20cbc1806f853cdfb1b35ea
go-toolset-1.18-golang-1.18.9-1.el7_9.ppc64le.rpm SHA-256: 5bac9093215b20e4d94647de3755bf6f4729795a444d68e0641e6f1eddcaca3f
go-toolset-1.18-golang-bin-1.18.9-1.el7_9.ppc64le.rpm SHA-256: ed8cb1b97ccdd0fe992834874e0a8283d3ac6adb220d81ab566efb7183b54695
go-toolset-1.18-golang-docs-1.18.9-1.el7_9.noarch.rpm SHA-256: c61ed95639a77f7ba28ad98c37017696dae7d91e591773d243e8b23c5cf05752
go-toolset-1.18-golang-misc-1.18.9-1.el7_9.ppc64le.rpm SHA-256: 2da02ebe0886563ad8c4d63907a9a55f71ecb970f3e147b5a75f0cb52fd192d2
go-toolset-1.18-golang-src-1.18.9-1.el7_9.ppc64le.rpm SHA-256: d8f8c2a787697fd509f554400ef46663eb96dcca76c8ae93ed330963eb777dc7
go-toolset-1.18-golang-tests-1.18.9-1.el7_9.ppc64le.rpm SHA-256: 72832a8e08ddc7bda2f7203e6ea69ea717856f625beb09054427a51b93597e63
go-toolset-1.18-runtime-1.18.9-1.el7_9.ppc64le.rpm SHA-256: 1576d80886787211561efb99600c8059b95c1943de05a7e290b233ee0161e14b
go-toolset-1.18-scldevel-1.18.9-1.el7_9.ppc64le.rpm SHA-256: d64bcef339ad50d2ff6dc6d0848804ede44ca0dea65ddc1675aa4527ff0ff4a1

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.