SUSE-SU-2021:4186-1

Details

Description of the patch:

This update for go1.17 fixes the following issues:

Updated to upstream version 1.17.5 to include fixes to the compiler, linker, syscall, runtime, the net/http, go/types, and time packages (bsc#1190649)

CVE-2021-44717: syscall: don't close fd 0 on ForkExec error (bsc#1193598).
CVE-2021-44716: net/http: limit growth of header canonicalization cache (bsc#1193597).

Affected Packages

go1.17

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.17.5-1.14.2

go1.17-doc

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.17.5-1.14.2

go1.17-race

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP2

Fixed in:

1.17.5-1.14.2

References

ADVISORY

https://bugzilla.suse.com/1190649

ADVISORY

https://bugzilla.suse.com/1193597

ADVISORY

https://bugzilla.suse.com/1193598

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2021-December/009942.html

ADVISORY

https://www.suse.com/security/cve/CVE-2021-44716/

ADVISORY

https://www.suse.com/security/cve/CVE-2021-44717/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2021/suse-su-20214186-1/