November 2020 - openSUSE Bugs - openSUSE Mailing Lists

[opensuse-bugs] [Bug 1178752] VUL-0: CVE-2020-28367: go cmd/go: improper validation of cgo flags can lead to remote code execution at build time
by bugzilla_noreply＠suse.com 13 Nov '20

13 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178752 https://bugzilla.suse.com/show_bug.cgi?id=1178752#c1 --- Comment #1 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1178752) was mentioned in https://build.opensuse.org/request/show/848227 Factory / go1.15 https://build.opensuse.org/request/show/848228 Factory / go1.14 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178750] VUL-0: CVE-2020-28362: go math/big: panic during recursive division of very large numbers
by bugzilla_noreply＠suse.com 13 Nov '20

13 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178750 https://bugzilla.suse.com/show_bug.cgi?id=1178750#c1 --- Comment #1 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1178750) was mentioned in https://build.opensuse.org/request/show/848227 Factory / go1.15 https://build.opensuse.org/request/show/848228 Factory / go1.14 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1175132] go1.15 release tracking
by bugzilla_noreply＠suse.com 13 Nov '20

13 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1175132 https://bugzilla.suse.com/show_bug.cgi?id=1175132#c8 --- Comment #8 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1175132) was mentioned in https://build.opensuse.org/request/show/848227 Factory / go1.15 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1164903] go1.14 release tracking
by bugzilla_noreply＠suse.com 13 Nov '20

13 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1164903 https://bugzilla.suse.com/show_bug.cgi?id=1164903#c30 --- Comment #30 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1164903) was mentioned in https://build.opensuse.org/request/show/848228 Factory / go1.14 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178753] VUL-0: CVE-2020-28366: go cmd/go: arbitrary code can be injected into cgo generated files
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178753 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178752] VUL-0: CVE-2020-28367: go cmd/go: improper validation of cgo flags can lead to remote code execution at build time
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178752 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178750] New: (CVE-2020-28362) VUL-0: CVE-2020-28362: go math/big: panic during recursive division of very large numbers
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1178750 Bug ID: 1178750 Summary: (CVE-2020-28362) VUL-0: CVE-2020-28362: go math/big: panic during recursive division of very large numbers Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- CVE-2020-28362 A number of Go math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures). Multiple math/big.Rat methods are similarly affected. crypto/rsa.VerifyPSS, crypto/rsa.VerifyPKCS1v15, and crypto/dsa.Verify may panic when provided crafted public keys and signatures. crypto/ecdsa and crypto/elliptic operations may only be affected if custom CurveParams with unusually large field sizes (several times larger than the largest supported curve, P-521) are in use. Using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don��t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request or during a golang.org/x/crypto/otr conversation. Parsing a golang.org/x/crypto/openpgp Entity or verifying a signature may crash. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key. Thanks to the Go Ethereum team and the OSS-Fuzz project for reporting this. Thanks to R��my Oudompheng and Robert Griesemer for their help developing and validating the fix. References: https://github.com/golang/go/issues/42552 https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[opensuse-bugs] [Bug 1178753] New: VUL-0: CVE-2020-28366: go cmd/go: arbitrary code can be injected into cgo generated files
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1178753 Bug ID: 1178753 Summary: VUL-0: CVE-2020-28366: go cmd/go: arbitrary code can be injected into cgo generated files Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- CVE-2020-28366 The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious unquoted symbol names. This has been fixed by rejecting invalid symbols which may add a //go:cgo_ldflag directive to the generated file, and by ensuring that the go tool follows existing LDFLAG restrictions. Thanks to Chris Brown and Tempus Ex for reporting this issue. References: https://github.com/golang/go/issues/42559 https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178752] New: VUL-0: CVE-2020-28367: go cmd/go: improper validation of cgo flags can lead to remote code execution at build time
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1178752 Bug ID: 1178752 Summary: VUL-0: CVE-2020-28367: go cmd/go: improper validation of cgo flags can lead to remote code execution at build time Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jkowalczyk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- CVE-2020-28367 The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by a malicious gcc flags specified via a #cgo directive. Thanks to Imre Rad for reporting this issue. References: https://github.com/golang/go/issues/42556 https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178750] (CVE-2020-28362) VUL-0: CVE-2020-28362: go math/big: panic during recursive division of very large numbers
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178750 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0