rhsa-2024_3259
Vulnerability from csaf_redhat
Published
2024-05-22 11:47
Modified
2024-11-14 00:32
Summary
Red Hat Security Advisory: go-toolset:rhel8 security update
Notes
Topic
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)
* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)
* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
* golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
* golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n\n* golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)\n\n* golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:3259", "url": "https://access.redhat.com/errata/RHSA-2024:3259" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2268017", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268017" }, { "category": "external", "summary": "2268018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268018" }, { "category": "external", "summary": "2268019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268019" }, { "category": "external", "summary": "2268021", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268021" }, { "category": "external", "summary": "2268022", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268022" }, { "category": "external", "summary": "2268273", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3259.json" } ], "title": "Red Hat Security Advisory: go-toolset:rhel8 security update", "tracking": { "current_release_date": "2024-11-14T00:32:22+00:00", "generator": { "date": "2024-11-14T00:32:22+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.0" } }, "id": "RHSA-2024:3259", "initial_release_date": "2024-05-22T11:47:21+00:00", "revision_history": [ { "date": "2024-05-22T11:47:21+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-05-22T11:47:21+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-14T00:32:22+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "go-toolset:rhel8:8100020240412145753:a3795dee", "product": { "name": "go-toolset:rhel8:8100020240412145753:a3795dee", "product_id": "go-toolset:rhel8:8100020240412145753:a3795dee", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/go-toolset@rhel8:8100020240412145753:a3795dee" } } }, { "category": "product_version", "name": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product": { "name": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_id": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-docs@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch" } } }, { "category": "product_version", "name": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product": { "name": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_id": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-misc@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch" } } }, { "category": "product_version", "name": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product": { "name": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_id": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-src@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch" } } }, { "category": "product_version", "name": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product": { "name": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_id": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-tests@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "product": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=src" } } }, { "category": "product_version", "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "product": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=src" } } }, { "category": "product_version", "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "product": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=x86_64" } } }, { "category": "product_version", "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product": { "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product_id": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=x86_64" } } }, { "category": "product_version", "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product": { "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product_id": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=x86_64" } } }, { "category": "product_version", "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=x86_64" } } }, { "category": "product_version", "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=x86_64" } } }, { "category": "product_version", "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=s390x" } } }, { "category": "product_version", "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=s390x" } } }, { "category": "product_version", "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=ppc64le" } } }, { "category": "product_version", "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product": { "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product_id": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=ppc64le" } } }, { "category": "product_version", "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product": { "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product_id": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=ppc64le" } } }, { "category": "product_version", "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=ppc64le" } } }, { "category": "product_version", "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=ppc64le" } } }, { "category": "product_version", "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=aarch64" } } }, { "category": "product_version", "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product": { "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product_id": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=aarch64" } } }, { "category": "product_version", "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product": { "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product_id": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=aarch64" } } }, { "category": "product_version", "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=aarch64" } } }, { "category": "product_version", "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=aarch64" } } }, { "category": "product_version", "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, "product_reference": "go-toolset:rhel8:8100020240412145753:a3795dee", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64" }, "product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le" }, "product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src" }, "product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64" }, "product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64" }, "product_reference": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le" }, "product_reference": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64" }, "product_reference": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64" }, "product_reference": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le" }, "product_reference": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64" }, "product_reference": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64" }, "product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le" }, "product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x" }, "product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src" }, "product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64" }, "product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64" }, "product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le" }, "product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x" }, "product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src" }, "product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64" }, "product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64" }, "product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le" }, "product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x" }, "product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64" }, "product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" }, "product_reference": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" }, "product_reference": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" }, "product_reference": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" }, { "category": "default_component_of", "full_product_name": { "name": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" }, "product_reference": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Bartek Nowotarski" ], "organization": "nowotarski.info" } ], "cve": "CVE-2023-45288", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2024-03-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2268273" } ], "notes": [ { "category": "description", "text": "A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is not a suitable mitigation for all use cases. Once an attack has ended, the system should return to normal operations on its own.\n\nThis vulnerability only impacts servers which have HTTP/2 enabled. It stems from an imperfect definition of the protocol. As the Go programming language is widely utilized across nearly every major Red Hat offering, a full listing of impacted packages will not be provided. Therefore, the \u201cAffected Packages and Issued Red Hat Security Errata\u201d section contains a simplified list of what offerings need to remediate this vulnerability. Every impacted offering has at least one representative component listed, but potentially not all of them. Rest assured that Red Hat is committed to remediating this vulnerability across our entire portfolio.\n\nMany components are rated as Low impact due to configurations which reduce the attack surface or significantly increase the difficulty of exploitation. A summary of these scenarios are:\n* The container includes a package that provides a vulnerable webserver, but it is not used or running during operation\n* HTTP/2 is disabled by default and is not supported\n* Only a client implementation is provided, which is not vulnerable\n* A vulnerable module (either golang.org/net/http or golang.org/x/net/http2) is included, but disabled\n* Access to a vulnerable server is restricted within the container (loopback only connections)\n* Golang is available in the container but is not used\n\n\nWithin the Red Hat OpenShift Container Platform, the majority of vulnerable components are not externally accessible. This means an attacker must already have access to a container within your environment to exploit this vulnerability. However, the ose-hyperkube (openshift-enterprise-hyperkube) container is externally accessible, so there are less barriers to exploitation. Fixes for this specific container are already available.\n\nWithin Red Hat Ansible Automation Platform, the impacted component is Receptor. The impact has been reduced to Low as the vulnerable code is present, but not utilized. There are three potential exposures within this component:\n* Receptor utilizes QUIC a UDP based protocol which does not run over HTTP/2\n* Receptor utilizes the x/net/ipv4 and ipv6 packages, both of which are not affected", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-45288" }, { "category": "external", "summary": "RHBZ#2268273", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45288", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45288" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288" }, { "category": "external", "summary": "https://nowotarski.info/http2-continuation-flood/", "url": "https://nowotarski.info/http2-continuation-flood/" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2024-2687", "url": "https://pkg.go.dev/vuln/GO-2024-2687" }, { "category": "external", "summary": "https://www.kb.cert.org/vuls/id/421644", "url": "https://www.kb.cert.org/vuls/id/421644" } ], "release_date": "2024-04-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T11:47:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3259" }, { "category": "workaround", "details": "In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS" }, { "cve": "CVE-2023-45289", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2024-03-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2268018" } ], "notes": [ { "category": "description", "text": "A flaw was found in Go\u0027s net/http/cookiejar standard library package. When following an HTTP redirect to a domain that is not a subdomain match or an exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-45289" }, { "category": "external", "summary": "RHBZ#2268018", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268018" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45289", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45289" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45289", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45289" } ], "release_date": "2024-03-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T11:47:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3259" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect" }, { "cve": "CVE-2023-45290", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2024-03-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2268017" } ], "notes": [ { "category": "description", "text": "A flaw was discovered in Go\u0027s net/http standard library package. When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-45290" }, { "category": "external", "summary": "RHBZ#2268017", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268017" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45290", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45290" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4", "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4" }, { "category": "external", "summary": "https://go.dev/cl/569341", "url": "https://go.dev/cl/569341" }, { "category": "external", "summary": "https://go.dev/issue/65383", "url": "https://go.dev/issue/65383" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg", "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2024-2599", "url": "https://pkg.go.dev/vuln/GO-2024-2599" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240329-0004", "url": "https://security.netapp.com/advisory/ntap-20240329-0004" } ], "release_date": "2024-03-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T11:47:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3259" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm" }, { "cve": "CVE-2024-24783", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2024-03-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2268019" } ], "notes": [ { "category": "description", "text": "A flaw was found in Go\u0027s crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-24783" }, { "category": "external", "summary": "RHBZ#2268019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268019" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24783", "url": "https://www.cve.org/CVERecord?id=CVE-2024-24783" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4", "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp", "url": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp" }, { "category": "external", "summary": "https://go.dev/cl/569339", "url": "https://go.dev/cl/569339" }, { "category": "external", "summary": "https://go.dev/issue/65390", "url": "https://go.dev/issue/65390" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg", "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2024-2598", "url": "https://pkg.go.dev/vuln/GO-2024-2598" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240329-0005", "url": "https://security.netapp.com/advisory/ntap-20240329-0005" } ], "release_date": "2024-03-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T11:47:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3259" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm" }, { "cve": "CVE-2024-24784", "cwe": { "id": "CWE-115", "name": "Misinterpretation of Input" }, "discovery_date": "2024-03-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2268021" } ], "notes": [ { "category": "description", "text": "A flaw was found in Go\u0027s net/mail standard library package. The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using different parsers.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: net/mail: comments in display names are incorrectly handled", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-24784" }, { "category": "external", "summary": "RHBZ#2268021", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268021" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24784", "url": "https://www.cve.org/CVERecord?id=CVE-2024-24784" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24784", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24784" } ], "release_date": "2024-03-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T11:47:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3259" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: net/mail: comments in display names are incorrectly handled" }, { "cve": "CVE-2024-24785", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)" }, "discovery_date": "2024-03-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2268022" } ], "notes": [ { "category": "description", "text": "A flaw was found in Go\u0027s html/template standard library package. If errors returned from MarshalJSON methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing subsequent actions to inject unexpected content into templates.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang: html/template: errors returned from MarshalJSON methods may break template escaping", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-24785" }, { "category": "external", "summary": "RHBZ#2268022", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268022" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2024-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24785" }, { "category": "external", "summary": "https://go.dev/cl/564196", "url": "https://go.dev/cl/564196" }, { "category": "external", "summary": "https://go.dev/issue/65697", "url": "https://go.dev/issue/65697" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg", "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg" }, { "category": "external", "summary": "https://vuln.go.dev/ID/GO-2024-2610.json", "url": "https://vuln.go.dev/ID/GO-2024-2610.json" } ], "release_date": "2024-03-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-05-22T11:47:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:3259" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch", "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "golang: html/template: errors returned from MarshalJSON methods may break template escaping" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.