RHSA-2022:5866: Important: go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
Go Toolset provides the Go programming language tools and libraries. Go is<br>alternatively known as golang.<br>Security Fix(es):<br><li> golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)</li> <li> golang: net/<a href="http:" target="blank">http:</a> improper sanitization of Transfer-Encoding header (CVE-2022-1705)</li> <li> golang: go/parser: stack exhaustion in all Parse functions (CVE-2022-1962)</li> <li> golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)</li> <li> golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)</li> <li> golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)</li> <li> golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)</li> <li> golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)</li> <li> golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> Clean up dist-git patches (BZ#2109172)</li> <li> Update Go to version 1.17.12 (BZ#2109184)</li>
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:5866?
The severity of RHSA-2022:5866 is classified as moderate.
How do I fix RHSA-2022:5866?
To fix RHSA-2022:5866, update the affected packages to the remedial versions, such as 1.17-1.17.12-1.el7_9.
What vulnerabilities are addressed in RHSA-2022:5866?
RHSA-2022:5866 addresses vulnerabilities including a stack exhaustion issue in compress/gzip and an improper handling issue in net/http.
Which versions of Go Toolset are affected by RHSA-2022:5866?
Affected versions of Go Toolset under RHSA-2022:5866 include all versions prior to 1.17-1.17.12-1.el7_9.
Is there a specific CVE associated with RHSA-2022:5866?
Yes, RHSA-2022:5866 references CVE-2022-30631, which pertains to the stack exhaustion in Reader.Read.