An update for golang is now available for openEuler-22.03-LTS-SP2 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2023-1499 Final 1.0 1.0 2023-08-12 Initial 2023-08-12 2023-08-12 openEuler SA Tool V1.0 2023-08-12 golang security update An update for golang is now available for openEuler-22.03-LTS-SP2. The Go Programming Language. Security Fix(es): The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.(CVE-2023-29404) The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.(CVE-2023-29405) The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.(CVE-2023-29406) An update for golang is now available for openEuler-22.03-LTS-SP2. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical golang https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1499 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-29404 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-29405 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-29406 https://nvd.nist.gov/vuln/detail/CVE-2023-29404 https://nvd.nist.gov/vuln/detail/CVE-2023-29405 https://nvd.nist.gov/vuln/detail/CVE-2023-29406 openEuler-22.03-LTS-SP2 golang-1.17.3-20.oe2203sp2.aarch64.rpm golang-help-1.17.3-20.oe2203sp2.noarch.rpm golang-devel-1.17.3-20.oe2203sp2.noarch.rpm golang-1.17.3-20.oe2203sp2.src.rpm golang-1.17.3-20.oe2203sp2.x86_64.rpm The go command may execute arbitrary code at build time when using cgo. This may occur when running go get on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a #cgo LDFLAGS directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. 2023-08-12 CVE-2023-29404 openEuler-22.03-LTS-SP2 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H golang security update 2023-08-12 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1499 The go command may execute arbitrary code at build time when using cgo. This may occur when running go get on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. 2023-08-12 CVE-2023-29405 openEuler-22.03-LTS-SP2 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H golang security update 2023-08-12 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1499 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. 2023-08-12 CVE-2023-29406 openEuler-22.03-LTS-SP2 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N golang security update 2023-08-12 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1499