Red Hat Security Advisory

RHSA-2023:3083

go-toolset:rhel8 security and bug fix update

Released 2023-05-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.6-1.module+el8.8.0+18289+edd6c8b6.aarch64::go-toolset:rhel8 +18

Fixes 3 records

TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

MEDIUM 46

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04561 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 +1 CWE-400

TI-2022-20116 CVE-2022-41725 · GHSA-w4h2-22wh-m6jx

Excessive resource consumption in mime/multipart

MEDIUM 41

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01241 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 CWE-770

TI-2022-20115 CVE-2022-41724 · GHSA-89mw-w342-mqrr

Panic on large handshake records in crypto/tls

MEDIUM 41

Large handshake records may cause panics in crypto/tls.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 CWE-400