Red Hat Security AdvisoryRHSA-2022:5415
go-toolset-1.17 and go-toolset-1.17-golang security and bug fix update
Released 2022-06-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.17-golang-1.17.10-1.el7_9, go-toolset-1.17-golang-bin-1.17.10-1.el7_9, go-toolset-1.17-golang-docs-1.17.10-1.el7_9 +4
Fixes 3 records
Priority MEDIUM 45
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0995 · Published 2022-04-20 · Partial fix CWE-674
Priority MEDIUM 40
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0416 · Published 2022-04-20 · Partial fix
Priority LOW 39
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03228 · Published 2022-03-05 · Partial fix CWE-674
