Bug 673234 – <dev-lang/go-{1.10.7,1.11.4}: Multiple vulnerabilities (CVE-2018-{16873,16874,16875})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Mikle Kolyada (RETIRED) 2018-12-16 09:37:54 UTC]

We have just released Go 1.11.3 and Go 1.10.6 to address three recently reported security issues. We recommend that all users update to one of these releases (if you’re not sure which, choose Go 1.11.3).

cmd/go: remote command execution during "go get -u"
The issue is CVE-2018-16873 and Go issue golang.org/issue/29230. See the Go issue for details.

Thanks to Etienne Stalmans from the Heroku platform security team for discovering and reporting this issue.
cmd/go: directory traversal in "go get" via curly braces in import paths
The issue is CVE-2018-16874 and Go issue golang.org/issue/29231. See the Go issue for details.

Thanks to ztz of Tencent Security Platform for discovering and reporting this issue.
crypto/x509: CPU denial of service in chain validation
The issue is CVE-2018-16875 and Go issue golang.org/issue/29233. See the Go issue for details.
Thanks to Netflix for discovering and reporting this issue.

[Comment 1 William Hubbs 2018-12-17 17:15:59 UTC]

dev-lang/go 1.10.6 and 1.11.4 are now in the tree.
I am fine with fast stabilizing them.

[Comment 2 William Hubbs 2018-12-17 18:31:31 UTC]

dev-lang/go-1.10.7 was just added.
We need to fast stable 1.10.7 and 1.11.3.

[Comment 3 William Hubbs 2018-12-17 18:32:06 UTC]

I meant 1.11.4.

[Comment 4 Mikle Kolyada (RETIRED) 2018-12-17 18:33:58 UTC]

(In reply to William Hubbs from comment #2)
> dev-lang/go-1.10.7 was just added.
> We need to fast stable 1.10.7 and 1.11.3.

1.11 series has never had stable keywords at all, so it is likely we shall only stabilize 1.10.7

[Comment 5 William Hubbs 2018-12-17 18:42:01 UTC]

I am fine with going ahead with stabilizing 1.11.4 as well, 1.11.2 has
been in the tree more than 30 days.

[Comment 6 Mikle Kolyada (RETIRED) 2018-12-17 18:49:09 UTC]

as discussed in in irc 1.11.4 will be stabilized alongside with 1.10.7

[Comment 7 William Hubbs 2018-12-18 15:32:13 UTC]

Arch teams,

please stabilize dev-lang/go 1.10.7 and 1.11.4.

Thanks,

William

[Comment 8 Thomas Deutschmann (RETIRED) 2018-12-20 01:29:47 UTC]

x86 stable

[Comment 9 Larry the Git Cow 2018-12-20 14:47:25 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=57897bad2d7ac8e0e5cb773f0c1e606f3be0a915

commit 57897bad2d7ac8e0e5cb773f0c1e606f3be0a915
Author:     William Hubbs <[e-mail]>
AuthorDate: 2018-12-20 14:44:53 +0000
Commit:     William Hubbs <[e-mail]>
CommitDate: 2018-12-20 14:45:19 +0000

    dev-lang/go: stabilize 1.10.7 and 1.11.4 on amd64 for bug #673234
    
    Bug: https://bugs.gentoo.org/673234
    Package-Manager: Portage-2.3.51, Repoman-2.3.11
    Signed-off-by: William Hubbs <[e-mail]>

 dev-lang/go/go-1.10.7.ebuild | 2 +-
 dev-lang/go/go-1.11.4.ebuild | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

[Comment 10 Mikle Kolyada (RETIRED) 2018-12-20 18:45:12 UTC]

GLSA is ready for review

[Comment 11 GLSAMaker/CVETool Bot 2018-12-21 12:03:57 UTC]

This issue was resolved and addressed in
 GLSA 201812-09 at https://security.gentoo.org/glsa/201812-09
by GLSA coordinator Mikle Kolyada (Zlogene).