Security update for go1.21
Announcement ID: |
SUSE-SU-2023:4471-1 |
Rating: |
moderate |
References: |
|
Cross-References:
|
|
CVSS scores: |
-
CVE-2023-45283
(
SUSE
):
6.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
-
CVE-2023-45284
(
SUSE
):
6.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
|
Affected Products: |
- Development Tools Module 15-SP4
- Development Tools Module 15-SP5
- openSUSE Leap 15.4
- openSUSE Leap 15.5
- SUSE Linux Enterprise Desktop 15 SP4
- SUSE Linux Enterprise Desktop 15 SP5
- SUSE Linux Enterprise High Performance Computing 15 SP4
- SUSE Linux Enterprise High Performance Computing 15 SP5
- SUSE Linux Enterprise Real Time 15 SP4
- SUSE Linux Enterprise Real Time 15 SP5
- SUSE Linux Enterprise Server 15 SP4
- SUSE Linux Enterprise Server 15 SP5
- SUSE Linux Enterprise Server for SAP Applications 15 SP4
- SUSE Linux Enterprise Server for SAP Applications 15 SP5
- SUSE Manager Proxy 4.3
- SUSE Manager Retail Branch Server 4.3
- SUSE Manager Server 4.3
|
An update that solves two vulnerabilities and has one security fix can now be installed.
Description:
This update for go1.21 fixes the following issues:
go1.21.4 (released 2023-11-07) includes security fixes to the
path/filepath package, as well as bug fixes to the linker, the
runtime, the compiler, and the go/types, net/http, and
runtime/cgo packages.
- security: fix CVE-2023-45283 CVE-2023-45284 path/filepath: insecure parsing of Windows paths (bsc#1216943, bsc#1216944)
- spec: update unification rules
- cmd/compile: internal compiler error: expected struct value to have type struct
- cmd/link: split text sections for arm 32-bit
- runtime: MADV_COLLAPSE causes production performance issues on Linux
- go/types, x/tools/go/ssa: panic: type param without replacement encountered
- cmd/compile: -buildmode=c-archive produces code not suitable for use in a shared object on arm64
- net/http: http2 page fails on firefox/safari if pushing resources
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4471=1
-
openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4471=1
-
Development Tools Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4471=1
-
Development Tools Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-4471=1
Package List:
-
openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
- go1.21-1.21.4-150000.1.15.1
- go1.21-race-1.21.4-150000.1.15.1
- go1.21-doc-1.21.4-150000.1.15.1
-
openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
- go1.21-1.21.4-150000.1.15.1
- go1.21-race-1.21.4-150000.1.15.1
- go1.21-doc-1.21.4-150000.1.15.1
-
Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64)
- go1.21-1.21.4-150000.1.15.1
- go1.21-doc-1.21.4-150000.1.15.1
-
Development Tools Module 15-SP4 (aarch64 x86_64)
- go1.21-race-1.21.4-150000.1.15.1
-
Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64)
- go1.21-1.21.4-150000.1.15.1
- go1.21-race-1.21.4-150000.1.15.1
- go1.21-doc-1.21.4-150000.1.15.1
References: