rhsa-2024_3259
Vulnerability from csaf_redhat
Published
2024-05-22 11:47
Modified
2024-11-06 19:58
Summary
Red Hat Security Advisory: go-toolset:rhel8 security update
Notes
Topic
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)
* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)
* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
* golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
* golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)\n\n* golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289)\n\n* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)\n\n* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)\n\n* golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)\n\n* golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2024:3259",
"url": "https://access.redhat.com/errata/RHSA-2024:3259"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2268017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268017"
},
{
"category": "external",
"summary": "2268018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268018"
},
{
"category": "external",
"summary": "2268019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268019"
},
{
"category": "external",
"summary": "2268021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268021"
},
{
"category": "external",
"summary": "2268022",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268022"
},
{
"category": "external",
"summary": "2268273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3259.json"
}
],
"title": "Red Hat Security Advisory: go-toolset:rhel8 security update",
"tracking": {
"current_release_date": "2024-11-06T19:58:16+00:00",
"generator": {
"date": "2024-11-06T19:58:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2024:3259",
"initial_release_date": "2024-05-22T11:47:21+00:00",
"revision_history": [
{
"date": "2024-05-22T11:47:21+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-05-22T11:47:21+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-06T19:58:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset:rhel8:8100020240412145753:a3795dee",
"product": {
"name": "go-toolset:rhel8:8100020240412145753:a3795dee",
"product_id": "go-toolset:rhel8:8100020240412145753:a3795dee",
"product_identification_helper": {
"purl": "pkg:rpmmod/redhat/go-toolset@rhel8:8100020240412145753:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product": {
"name": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_id": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-docs@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product": {
"name": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_id": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-misc@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product": {
"name": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_id": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-src@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product": {
"name": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_id": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-tests@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"product": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=src"
}
}
},
{
"category": "product_version",
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"product": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=src"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"product": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product": {
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product_id": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product": {
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product_id": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product": {
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product_id": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product": {
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product_id": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product_id": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product": {
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product_id": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debuginfo@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product": {
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product_id": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debugsource@1.21.2-3.module%2Bel8.10.0%2B21244%2B5b2d9000?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product_id": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product_id": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product_id": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.21.9-1.module%2Bel8.10.0%2B21671%2Bb35c3b78?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
"product_reference": "go-toolset:rhel8:8100020240412145753:a3795dee",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64"
},
"product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le"
},
"product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src"
},
"product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64"
},
"product_reference": "delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64"
},
"product_reference": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le"
},
"product_reference": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64"
},
"product_reference": "delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64"
},
"product_reference": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le"
},
"product_reference": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64"
},
"product_reference": "delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64"
},
"product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le"
},
"product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x"
},
"product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src"
},
"product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64"
},
"product_reference": "go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64"
},
"product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le"
},
"product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x"
},
"product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src"
},
"product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64"
},
"product_reference": "golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64"
},
"product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le"
},
"product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x"
},
"product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64 as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64"
},
"product_reference": "golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
},
"product_reference": "golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
},
"product_reference": "golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
},
"product_reference": "golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch as a component of go-toolset:rhel8:8100020240412145753:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
},
"product_reference": "golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Bartek Nowotarski"
],
"organization": "nowotarski.info"
}
],
"cve": "CVE-2023-45288",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268273"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is not a suitable mitigation for all use cases. Once an attack has ended, the system should return to normal operations on its own.\n\nThis vulnerability only impacts servers which have HTTP/2 enabled. It stems from an imperfect definition of the protocol. As the Go programming language is widely utilized across nearly every major Red Hat offering, a full listing of impacted packages will not be provided. Therefore, the \u201cAffected Packages and Issued Red Hat Security Errata\u201d section contains a simplified list of what offerings need to remediate this vulnerability. Every impacted offering has at least one representative component listed, but potentially not all of them. Rest assured that Red Hat is committed to remediating this vulnerability across our entire portfolio.\n\nMany components are rated as Low impact due to configurations which reduce the attack surface or significantly increase the difficulty of exploitation. A summary of these scenarios are:\n* The container includes a package that provides a vulnerable webserver, but it is not used or running during operation\n* HTTP/2 is disabled by default and is not supported\n* Only a client implementation is provided, which is not vulnerable\n* A vulnerable module (either golang.org/net/http or golang.org/x/net/http2) is included, but disabled\n* Access to a vulnerable server is restricted within the container (loopback only connections)\n* Golang is available in the container but is not used\n\n\nWithin the Red Hat OpenShift Container Platform, the majority of vulnerable components are not externally accessible. This means an attacker must already have access to a container within your environment to exploit this vulnerability. However, the ose-hyperkube (openshift-enterprise-hyperkube) container is externally accessible, so there are less barriers to exploitation. Fixes for this specific container are already available.\n\nWithin Red Hat Ansible Automation Platform, the impacted component is Receptor. The impact has been reduced to Low as the vulnerable code is present, but not utilized. There are three potential exposures within this component:\n* Receptor utilizes QUIC a UDP based protocol which does not run over HTTP/2\n* Receptor utilizes the x/net/ipv4 and ipv6 packages, both of which are not affected",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "RHBZ#2268273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45288",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288"
},
{
"category": "external",
"summary": "https://nowotarski.info/http2-continuation-flood/",
"url": "https://nowotarski.info/http2-continuation-flood/"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2687",
"url": "https://pkg.go.dev/vuln/GO-2024-2687"
},
{
"category": "external",
"summary": "https://www.kb.cert.org/vuls/id/421644",
"url": "https://www.kb.cert.org/vuls/id/421644"
}
],
"release_date": "2024-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T11:47:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3259"
},
{
"category": "workaround",
"details": "In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS"
},
{
"cve": "CVE-2023-45289",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2024-03-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268018"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s net/http/cookiejar standard library package. When following an HTTP redirect to a domain that is not a subdomain match or an exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45289"
},
{
"category": "external",
"summary": "RHBZ#2268018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268018"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45289",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45289"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45289",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45289"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T11:47:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect"
},
{
"cve": "CVE-2023-45290",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2024-03-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in Go\u0027s net/http standard library package. When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45290"
},
{
"category": "external",
"summary": "RHBZ#2268017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45290",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45290"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
},
{
"category": "external",
"summary": "https://go.dev/cl/569341",
"url": "https://go.dev/cl/569341"
},
{
"category": "external",
"summary": "https://go.dev/issue/65383",
"url": "https://go.dev/issue/65383"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2599",
"url": "https://pkg.go.dev/vuln/GO-2024-2599"
},
{
"category": "external",
"summary": "https://security.netapp.com/advisory/ntap-20240329-0004",
"url": "https://security.netapp.com/advisory/ntap-20240329-0004"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T11:47:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm"
},
{
"cve": "CVE-2024-24783",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-03-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268019"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24783"
},
{
"category": "external",
"summary": "RHBZ#2268019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268019"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24783",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp",
"url": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp"
},
{
"category": "external",
"summary": "https://go.dev/cl/569339",
"url": "https://go.dev/cl/569339"
},
{
"category": "external",
"summary": "https://go.dev/issue/65390",
"url": "https://go.dev/issue/65390"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2598",
"url": "https://pkg.go.dev/vuln/GO-2024-2598"
},
{
"category": "external",
"summary": "https://security.netapp.com/advisory/ntap-20240329-0005",
"url": "https://security.netapp.com/advisory/ntap-20240329-0005"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T11:47:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm"
},
{
"cve": "CVE-2024-24784",
"cwe": {
"id": "CWE-115",
"name": "Misinterpretation of Input"
},
"discovery_date": "2024-03-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268021"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s net/mail standard library package. The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using different parsers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/mail: comments in display names are incorrectly handled",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24784"
},
{
"category": "external",
"summary": "RHBZ#2268021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268021"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24784",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24784"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24784",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24784"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T11:47:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/mail: comments in display names are incorrectly handled"
},
{
"cve": "CVE-2024-24785",
"cwe": {
"id": "CWE-74",
"name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
},
"discovery_date": "2024-03-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268022"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s html/template standard library package. If errors returned from MarshalJSON methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing subsequent actions to inject unexpected content into templates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: html/template: errors returned from MarshalJSON methods may break template escaping",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24785"
},
{
"category": "external",
"summary": "RHBZ#2268022",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268022"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24785",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24785"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24785",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24785"
},
{
"category": "external",
"summary": "https://go.dev/cl/564196",
"url": "https://go.dev/cl/564196"
},
{
"category": "external",
"summary": "https://go.dev/issue/65697",
"url": "https://go.dev/issue/65697"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
},
{
"category": "external",
"summary": "https://vuln.go.dev/ID/GO-2024-2610.json",
"url": "https://vuln.go.dev/ID/GO-2024-2610.json"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-05-22T11:47:21+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2024:3259"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debuginfo-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:delve-debugsource-0:1.21.2-3.module+el8.10.0+21244+5b2d9000.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:go-toolset-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.src",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-bin-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-docs-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-misc-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-src-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020240412145753:a3795dee:golang-tests-0:1.21.9-1.module+el8.10.0+21671+b35c3b78.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: html/template: errors returned from MarshalJSON methods may break template escaping"
}
]
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.