Red Hat Security Advisory

RHSA-2024:1041

go-toolset-1.19-golang security update

Released 2024-02-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.19-golang-1.19.13-5.el7_9, go-toolset-1.19-golang-bin-1.19.13-5.el7_9, go-toolset-1.19-golang-docs-1.19.13-5.el7_9 +4
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.19-golang-1.19.13-5.el7_9, go-toolset-1.19-golang-bin-1.19.13-5.el7_9, go-toolset-1.19-golang-docs-1.19.13-5.el7_9 +4

Fixes 2 records

TI-2023-24275 CVE-2023-45285 · GHSA-5f94-vhjq-rpg8

Command 'go get' may unexpectedly fallback to insecure git in cmd/go

LOW 35

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is n…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01137 Published 2023-12-06 Partial fix · 1.20.12, 1.21.5

TI-2023-20467 CVE-2023-39326 · GHSA-9f76-wg39-x86h

Denial of service via chunk extensions in net/http

LOW 26

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01208 Published 2023-12-06 Partial fix · 1.20.12, 1.21.5