Red Hat Security Advisory

RHSA-2021:5176

go-toolset-1.16 and go-toolset-1.16-golang security and bug fix update

Released 2021-12-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.16-1.16.12-1.el7_9, go-toolset-1.16-build-1.16.12-1.el7_9, go-toolset-1.16-golang-1.16.12-1.el7_9 +8

Fixes 3 records

TI-2021-20237 CVE-2021-44716 · GHSA-vc3p-29h2-gpcp

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory…

MEDIUM 40

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04254 Published 2022-01-01 Partial fix · 0.0.0-20211209124913-491a49abca63 CWE-400

TI-2021-18416 CVE-2021-41772 · GHSA-8rv2-6fw3-rxjg

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a…

LOW 39

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03253 Published 2021-11-08 Partial fix CWE-20

TI-2021-20238 CVE-2021-44717 · GHSA-x9r7-cjm2-h6cp

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an…

LOW 26

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustio…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.01997 Published 2022-01-01 Partial fix CWE-404