DLA-3395-1

CVE-2021-39293 CVE-2021-41771 CVE-2021-44716 CVE-2021-44717 CVE-2022-23806 CVE-2022-24921 Debian Bug : 989492 991961

Multiple vulnerabilities were discovered in the Go programming language. An attacker could trigger a denial-of-service (DoS), invalid cryptographic computation, information leak, or arbitrary code execution on the developer's computer in specific situations.

CVE-2020-28367

Code injection in the go command with cgo allows arbitrary code
execution at build time via malicious gcc flags specified via a
#cgo directive.

CVE-2021-33196

In archive/zip, a crafted file count (in an archive's header) can
cause a NewReader or OpenReader panic.

CVE-2021-36221

Go has a race condition that can lead to a net/http/httputil
ReverseProxy panic upon an ErrAbortHandler abort.

CVE-2021-38297

Go has a Buffer Overflow via large arguments in a function
invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

CVE-2021-39293

This issue exists because of an incomplete fix for CVE-2021-33196.

CVE-2021-41771

ImportedSymbols in debug/macho (for Open or OpenFat) Accesses a
Memory Location After the End of a Buffer, aka an out-of-bounds
slice situation.

CVE-2021-44716

net/http allows uncontrolled memory consumption in the header
canonicalization cache via HTTP/2 requests.

CVE-2021-44717

Go on UNIX allows write operations to an unintended file or
unintended network connection as a consequence of erroneous
closing of file descriptor 0 after file-descriptor exhaustion.

CVE-2022-23806

Curve.IsOnCurve in crypto/elliptic can incorrectly return true in
situations with a big.Int value that is not a valid field element.

CVE-2022-24921

regexp.Compile allows stack exhaustion via a deeply nested
expression.