linux/poky.git/meta/recipes-devtools/go, branch yocto-4.0.14

go: Update fix for CVE-2023-24538 & CVE-2023-39318

2023-10-06T01:48:49+00:00

Add missing files in fix for CVE-2023-24538 & CVE-2023-39318 Upstream Link - CVE-2023-24538: https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b CVE-2023-39318: https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c (From OE-Core rev: 0d8f7062d4fb5525f34427b1a7304f165bee0cfc) Signed-off-by: Shubham Kulkarni Signed-off-by: Steve Sakoman

go: Fix CVE-2023-39318

2023-09-30T19:43:59+00:00

Upstream-Status: Backport from [https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c] CVE: CVE-2023-39318 (From OE-Core rev: 35fa5c12f86bda2c8542bdb57074f55808697a42) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

go: Fix CVE-2023-39319

2023-09-23T15:26:15+00:00

The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39319 (From OE-Core rev: afdc322ecff4cfd8478c89a03f7fce748a132b48) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

go: Fix CVE-2023-29409

2023-08-30T14:46:35+00:00

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29409 (From OE-Core rev: 51c2fee0e4bb4b3131c61d91510394cd4b4f9eb9) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

go: fix CVE-2023-24531

2023-08-07T14:40:44+00:00

Backport required patches from go1.21 to fix CVE-2023-24531. (From OE-Core rev: 6d892c52bd5806507a05e8b6f749c54bbd9e9da6) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman

go: fix CVE-2023-24536

2023-08-07T14:40:44+00:00

Backport required patches to fix CVE-2023-24536. (From OE-Core rev: a774c895f4a425979cef8e05e8dd17c2dcb67654) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman

go: fix CVE-2023-29406 net/http insufficient sanitization of Host header

2023-08-02T14:47:12+00:00

(From OE-Core rev: 5dc74138649ab7a2c0158a43225dc7a8fd732355) Signed-off-by: Vivek Kumbhar Signed-off-by: Steve Sakoman

go: fix CVE-2023-29400 html/template improper handling of empty HTML attributes

2023-07-12T15:11:37+00:00

(From OE-Core rev: 3224084a1ca301ff4fb4735ccc80d24aaec13257) Signed-off-by: Vivek Kumbhar Signed-off-by: Steve Sakoman

go: fix CVE-2023-29402

2023-07-01T18:37:24+00:00

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). References: https://nvd.nist.gov/vuln/detail/CVE-2023-29402 Upstream patches: https://github.com/golang/go/commit/4dae3bbe0e6a5700037bb996ae84d6f457c4f58a (From OE-Core rev: aeb0829e52c60a77a2135af8332435b6e2db5b3d) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

go: fix CVE-2023-29405

2023-07-01T18:37:24+00:00

The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29405 Upstream patches: https://github.com/golang/go/commit/6d8af00a630aa51134e54f0f321658621c6410f0 (From OE-Core rev: 7ce6d0029effc06cff500271a124150f1a7db7b3) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman