SUSE-SU-2022:4398-1

Details

Description of the patch:

This update for go1.18 fixes the following issues:

Update to version 1.18.9, includes the following security fixes:

CVE-2022-41717: net/http: limit canonical header cache by bytes, not entries (bsc#1206135)
CVE-2022-41720: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows (bsc#1206134)

Affected Packages

go1.18

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP4

Fixed in:

1.18.9-150000.1.40.1

go1.18-doc

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP4

Fixed in:

1.18.9-150000.1.40.1

go1.18-race

SUSE Enterprise Storage 7.1SUSE Linux Enterprise Desktop 15 SP3SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP3SUSE Linux Enterprise High Performance Computing 15 SP4

Fixed in:

1.18.9-150000.1.40.1

References

ADVISORY

https://bugzilla.suse.com/1193742

ADVISORY

https://bugzilla.suse.com/1206134

ADVISORY

https://bugzilla.suse.com/1206135

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2022-December/013214.html

ADVISORY

https://www.suse.com/security/cve/CVE-2022-41717/

ADVISORY

https://www.suse.com/security/cve/CVE-2022-41720/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2022/suse-su-20224398-1/