Important: golang security update

2024-05-1014:32:42

Google

osv.dev

golang

security update

memory leaks

memory exhaustion

incorrect forwarding

verify panics

comments

template errors

dos

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

30.8%

JSON

The golang packages provide the Go programming language compiler.

Security Fix(es):

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)
golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.