Shengjing Zhu pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
27e1419b by Shengjing Zhu at 2023-04-14T15:31:49+08:00
CVE-2022-41717 affects golang-golang-x-net as well
- - - - -
7a17025f by Shengjing Zhu at 2023-04-14T15:31:50+08:00
CVE-2022-41720/go affects cross compile for Windows binary
See 29f7d181bd88e363de11541667af407043579f00 as well
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -47319,12 +47319,13 @@ CVE-2022-41721 (A request smuggling attack is
possible when using MaxBytesHandle
NOTE: Fixed in
https://go.googlesource.com/net/+/702349b0e8628371f0e5ba0c10407448d60a67b1
(v0.2.0)
NOTE: Introduced in
https://go.googlesource.com/net/+/1d687d428aca0546c0ca84160c8700ee521e9fb9
(v0.1.0)
CVE-2022-41720 (On Windows, restricted files can be accessed via os.DirFS and
http.Dir ...)
- - golang-1.19 <not-affected> (Only affects Go on Windows)
- - golang-1.18 <not-affected> (Only affects Go on Windows)
- - golang-1.15 <not-affected> (Only affects Go on Windows)
- - golang-1.11 <not-affected> (Only affects Go on Windows)
+ - golang-1.19 1.19.4-1 (unimportant)
+ - golang-1.18 1.18.9-1 (unimportant)
+ - golang-1.15 <removed> (unimportant)
+ - golang-1.11 <removed> (unimportant)
NOTE: https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU
NOTE: https://go.dev/issue/56694
+ NOTE: Only affects code cross compiled on Debian for Windows binaries
CVE-2022-41719 (Unmarshal can panic on some inputs, possibly allowing for
denial of se ...)
NOT-FOR-US: shamaton/msgpack
CVE-2022-41718
@@ -47334,10 +47335,13 @@ CVE-2022-41717 (An attacker can cause excessive
memory growth in a Go server acc
- golang-1.18 1.18.9-1
- golang-1.15 <removed>
- golang-1.11 <removed>
+ - golang-golang-x-net <1:0.4.0+dfsg-1>
+ - golang-golang-x-net-dev <removed>
NOTE: https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU
NOTE: https://go.dev/issue/56350
NOTE:
https://github.com/golang/go/commit/618120c165669c00a1606505defea6ca755cdc27
(go1.19.4)
NOTE:
https://github.com/golang/go/commit/76cad4edc29d28432a7a0aa27e87385d3d7db7a1
(go1.18.9)
+ NOTE:
https://github.com/golang/net/commit/1e63c2f08a10a150fa02c50ece89b340ae64efe4
CVE-2022-41716 (Due to unsanitized NUL values, attackers may be able to
maliciously se ...)
- golang-1.19 <not-affected> (Only affects Go on Windows)
- golang-1.18 <not-affected> (Only affects Go on Windows)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/d04a648f5c2c49f0ecf9d049ec9b136058798e06...7a17025f958e6d71fc4ed28d472f026803278de9
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/d04a648f5c2c49f0ecf9d049ec9b136058798e06...7a17025f958e6d71fc4ed28d472f026803278de9
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
