SUSE-SU-2023:4709-1

Dashboard / Vulnerabilities / SUSE-SU-2023:4709-1

SUSE-SU-2023:4709-1

Summary: Security update for go1.21

Details: This update for go1.21 fixes the following issues: Update to go1.21.5: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834). - CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943). - CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833). - cmd/go: go mod download needs to support toolchain upgrades - cmd/compile: invalid pointer found on stack when compiled with -race - os: NTFS deduped file changed from regular to irregular - net: TCPConn.ReadFrom hangs when io.Reader is TCPConn or UnixConn, Linux kernel < 5.1 - cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents - syscall: TestOpenFileLimit unintentionally runs on non-Unix platforms - runtime: self-deadlock on mheap_.lock - crypto/rand: Legacy RtlGenRandom use on Windows

References: https://www.suse.com/support/update/announcement/2023/suse-su-20234709-1/, https://bugzilla.suse.com/1212475, https://bugzilla.suse.com/1216943, https://bugzilla.suse.com/1217833, https://bugzilla.suse.com/1217834, https://www.suse.com/security/cve/CVE-2023-39326, https://www.suse.com/security/cve/CVE-2023-45284, https://www.suse.com/security/cve/CVE-2023-45285