Debian alert DLA-2892-1 (golang-1.7)

From:
             
 
Sylvain Beucler <beuc@beuc.net>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 2892-1] golang-1.7 security update
Date:
             
 
Fri, 21 Jan 2022 23:02:47 +0100
Message-ID:
             
 
<20220121220247.GB4456@mail.beuc.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2892-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Sylvain Beucler
January 21, 2022                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : golang-1.7
Version        : 1.7.4-2+deb9u4
CVE ID         : CVE-2021-33196 CVE-2021-36221 CVE-2021-39293 CVE-2021-41771 
                 CVE-2021-44716 CVE-2021-44717
Debian Bug     : 989492 991961

Several vulnerabilities were discovered in the Go programming
language. An attacker could trigger a denial-of-service (DoS) and
information leak.

CVE-2021-33196

    In archive/zip, a crafted file count (in an archive's header) can
    cause a NewReader or OpenReader panic.

CVE-2021-36221

    Go has a race condition that can lead to a net/http/httputil
    ReverseProxy panic upon an ErrAbortHandler abort.

CVE-2021-39293

    Follow-up fix to CVE-2021-33196

CVE-2021-41771

    ImportedSymbols in debug/macho (for Open or OpenFat) accesses a
    Memory Location After the End of a Buffer, aka an out-of-bounds
    slice situation.

CVE-2021-44716

    net/http allows uncontrolled memory consumption in the header
    canonicalization cache via HTTP/2 requests.

CVE-2021-44717

    Go on UNIX allows write operations to an unintended file or
    unintended network connection as a consequence of erroneous
    closing of file descriptor 0 after file-descriptor exhaustion.

For Debian 9 stretch, these problems have been fixed in version
1.7.4-2+deb9u4.

We recommend that you upgrade your golang-1.7 packages.

For the detailed security status of golang-1.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.7

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmHrLRQACgkQDTl9HeUl
XjBUzA/7BTmHHwrqF5WWXDAuhiMtcaBKbYwmlbyesMCeyIBwhwJpuz5x+50psojO
Uw6+wem/XEoembVhklecWtN0UqdkOy6WFXBug2MH3qNuQkM/+Ujf14q7eGfMrXc9
e+DAty8kcExcR0iCpk/h6C9cLHTdOPCQlsnsPvH321RO7Ukv/OV16JgLv0PpKyrB
hbBvsY9q6XFPJGv62R6idLkEXOnlSaAAS10yrwBFTP9xGH3w42HTxa7BuuZsM+Cp
fzKJaKfLfKAtOjjX7vr4WDyR46525eieLkdt8zzIAwoHuQQTGkfa50CHEOvQW6sn
5cQm87O5u7vW39E8crrkXMvWSt7XpKvaeUerZL5lK2J459uAyrW/n7mRxOx9bRym
/pf7vfV0KTRoBPD+9IczLJH8j94sh5dcsrx5Q7p+KmYr4mT5IuFRhsGQiFjjrKth
oixdNTQwHeE/6ILBh35uqxIembfXDvuGIu2KNJSgE8yHlwf6sPSYVQJgdNAzd4yf
8GV82rmoV8eMwQvGZ2hiBsnWmKFpT320UEbwpy6TIeuxAT1K3CutzyYw27J59ydN
3y30UsFVgCG+fWSsh3ckC/1qpT/Sh4/GUodPSJ4LZveu6/RvLDIK5+/3N/qaDFEv
OXOxKrjmbB+uLeHLJqGH+xT7J5Y2VsKDylcHqSqavmkUaE0CPT0=
=yVSh
-----END PGP SIGNATURE-----