Advisories » MGASA-2020-0325

Updated golang packages fix security vulnerability

Publication date: 18 Aug 2020
Modification date: 18 Aug 2020
Type: security
Affected Mageia releases : 7
CVE: CVE-2020-15586 , CVE-2020-16845

Description

Servers where the Handler concurrently reads the request body and writes a
response can encounter a data race and crash. The httputil.ReverseProxy Handler
is affected (CVE-2020-15586).

Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions
to read an unlimited number of bytes from the ByteReader argument before
returning an error. This could lead to processing more input than expected when
the caller is reading directly from the network and depends on ReadUvarint and
ReadVarint only consuming a small, bounded number of bytes, even from invalid
inputs (CVE-2020-16845).

The golang package has been updated to version 1.13.15, fixing these issues
and containing several other bug fixes and enhancements.  See the 1.13 release
notes and other references for details.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=27039
• https://golang.org/doc/go1.13
• https://golang.org/doc/devel/release.html#go1.13.minor
• https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/golang-announce/XZNfaiwgt2w/E6gHDs32AQAJ
• https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!topic/golang-announce/NyPIaucMgXo
• https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15586
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845

SRPMS

7/core

• golang-1.13.15-1.mga7