An update for golang is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS and openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1386 Final 1.0 1.0 2023-07-01 Initial 2023-07-01 2023-07-01 openEuler SA Tool V1.0 2023-07-01 golang security update An update for golang is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS and openEuler-22.03-LTS-SP1. The Go Programming Language. Security Fix(es): The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).(CVE-2023-29402) The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.(CVE-2023-29404) The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.(CVE-2023-29405) An update for golang is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP3,openEuler-22.03-LTS and openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical golang https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1386 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-29402 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-29404 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-29405 https://nvd.nist.gov/vuln/detail/CVE-2023-29402 https://nvd.nist.gov/vuln/detail/CVE-2023-29404 https://nvd.nist.gov/vuln/detail/CVE-2023-29405 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS openEuler-22.03-LTS-SP1 golang-1.15.7-28.oe1.aarch64.rpm golang-1.15.7-28.oe1.aarch64.rpm golang-1.17.3-19.oe2203.aarch64.rpm golang-1.17.3-19.oe2203sp1.aarch64.rpm golang-help-1.15.7-28.oe1.noarch.rpm golang-devel-1.15.7-28.oe1.noarch.rpm golang-devel-1.15.7-28.oe1.noarch.rpm golang-help-1.15.7-28.oe1.noarch.rpm golang-devel-1.17.3-19.oe2203.noarch.rpm golang-help-1.17.3-19.oe2203.noarch.rpm golang-devel-1.17.3-19.oe2203sp1.noarch.rpm golang-help-1.17.3-19.oe2203sp1.noarch.rpm golang-1.15.7-28.oe1.src.rpm golang-1.15.7-28.oe1.src.rpm golang-1.17.3-19.oe2203.src.rpm golang-1.17.3-19.oe2203sp1.src.rpm golang-1.15.7-28.oe1.x86_64.rpm golang-1.15.7-28.oe1.x86_64.rpm golang-1.17.3-19.oe2203.x86_64.rpm golang-1.17.3-19.oe2203sp1.x86_64.rpm The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via go get , are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). 2023-07-01 CVE-2023-29402 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS openEuler-22.03-LTS-SP1 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H golang security update 2023-07-01 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1386 The go command may execute arbitrary code at build time when using cgo. This may occur when running go get on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a #cgo LDFLAGS directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. 2023-07-01 CVE-2023-29404 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS openEuler-22.03-LTS-SP1 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H golang security update 2023-07-01 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1386 The go command may execute arbitrary code at build time when using cgo. This may occur when running go get on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. 2023-07-01 CVE-2023-29405 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP3 openEuler-22.03-LTS openEuler-22.03-LTS-SP1 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H golang security update 2023-07-01 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1386