SUSE-SU-2021:4169-1

Details

Description of the patch:

This update for go1.16 fixes the following issues:

Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages (bsc#1182345)

CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598).
CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597).

Affected Packages

go1.16

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.16.12-1.37.2

go1.16-doc

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.16.12-1.37.2

go1.16-race

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.16.12-1.37.2

References

ADVISORY

https://bugzilla.suse.com/1182345

ADVISORY

https://bugzilla.suse.com/1193597

ADVISORY

https://bugzilla.suse.com/1193598

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2021-December/009938.html

ADVISORY

https://www.suse.com/security/cve/CVE-2021-44716/

ADVISORY

https://www.suse.com/security/cve/CVE-2021-44717/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2021/suse-su-20214169-1/