CVE-2021-3115 (golang.org/issue/43783): The go command may execute arbitrary code at build time when cgo is in use on Windows. This may occur when running “go get”, or any other command that builds code. Only users who build untrusted code (and don’t execute it) are affected. In addition to Windows users, this can also affect Unix users who have “.” listed explicitly in their PATH and are running “go get” or build commands outside of a module or with module mode disabled. Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue. For more background on the cmd/go change and help deciding whether your own programs might have similar issues, see our blog post at https://blog.golang.org/path-security. CVE-2021-3114 (golang.org/issue/43786): The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages support P-224 ECDSA keys, but they are not supported by publicly trusted certificate authorities. No other standard library or golang.org/x/crypto package supports or uses the P-224 curve. The incorrect output was found by the elliptic-curve-differential-fuzzer project running on OSS-Fuzz and reported by Philippe Antoine (Catena cyber). Fixed in 1.14.14 and 1.15.7. Please bump
These are in the tree.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ec2e47baa4227a13f55d6499312aaff571964b18 commit ec2e47baa4227a13f55d6499312aaff571964b18 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2021-01-21 15:54:42 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2021-01-21 15:57:17 +0000 dev-lang/go: stable 1.14.14 and 1.15.7 on amd64 Bug: https://bugs.gentoo.org/766216 Signed-off-by: William Hubbs <williamh@gentoo.org> dev-lang/go/go-1.14.14.ebuild | 2 +- dev-lang/go/go-1.15.7.ebuild | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
x86 done
arm64 done
ppc64 done
arm done all arches done
Please cleanup.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f94a9c778deffc13c4bcb9ec27d5cf90c19c1b5e commit f94a9c778deffc13c4bcb9ec27d5cf90c19c1b5e Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2021-01-28 00:17:12 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2021-01-28 00:17:41 +0000 dev-lang/go: remove 1.14.13-r1 and 1.15.6-r1 Bug: https://bugs.gentoo.org/766216 Signed-off-by: William Hubbs <williamh@gentoo.org> dev-lang/go/go-1.14.13-r1.ebuild | 197 --------------------------------------- dev-lang/go/go-1.15.6-r1.ebuild | 197 --------------------------------------- 2 files changed, 394 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=220629a3e1e453af234c61605a6c4ea2ff44d840 commit 220629a3e1e453af234c61605a6c4ea2ff44d840 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2021-01-28 00:21:23 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2021-01-28 00:21:56 +0000 dev-lang/go: fix manifest Bug: https://bugs.gentoo.org/766216 Signed-off-by: William Hubbs <williamh@gentoo.org> dev-lang/go/Manifest | 2 -- 1 file changed, 2 deletions(-)
Added to existing GLSA request.
Package list is empty or all packages have requested keywords.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=3cb3a96a3023359a20f60ec1f45f10c1fc4012ca commit 3cb3a96a3023359a20f60ec1f45f10c1fc4012ca Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-08-04 13:53:02 +0000 Commit: John Helmert III <ajak@gentoo.org> CommitDate: 2022-08-04 13:59:34 +0000 [ GLSA 202208-02 ] Go: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/754210 Bug: https://bugs.gentoo.org/766216 Bug: https://bugs.gentoo.org/775326 Bug: https://bugs.gentoo.org/788640 Bug: https://bugs.gentoo.org/794784 Bug: https://bugs.gentoo.org/802054 Bug: https://bugs.gentoo.org/806659 Bug: https://bugs.gentoo.org/807049 Bug: https://bugs.gentoo.org/816912 Bug: https://bugs.gentoo.org/821859 Bug: https://bugs.gentoo.org/828655 Bug: https://bugs.gentoo.org/833156 Bug: https://bugs.gentoo.org/834635 Bug: https://bugs.gentoo.org/838130 Bug: https://bugs.gentoo.org/843644 Bug: https://bugs.gentoo.org/849290 Bug: https://bugs.gentoo.org/857822 Bug: https://bugs.gentoo.org/862822 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: John Helmert III <ajak@gentoo.org> glsa-202208-02.xml | 101 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+)
GLSA released, all done!
