Security update for go1.20

Announcement ID: SUSE-SU-2023:2105-1
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2023-24534 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-24534 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-24536 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-24536 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-24537 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2023-24537 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2023-24538 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2023-24538 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2023-24539 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • CVE-2023-24539 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • CVE-2023-24540 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2023-24540 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2023-29400 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
  • CVE-2023-29400 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Products:
  • Development Tools Module 15-SP4
  • openSUSE Leap 15.4
  • SUSE Linux Enterprise Desktop 15 SP4
  • SUSE Linux Enterprise High Performance Computing 15 SP4
  • SUSE Linux Enterprise Real Time 15 SP4
  • SUSE Linux Enterprise Server 15 SP4
  • SUSE Linux Enterprise Server for SAP Applications 15 SP4
  • SUSE Manager Proxy 4.3
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.3

An update that solves seven vulnerabilities and has three security fixes can now be installed.

Description:

This update for go1.20 fixes the following issues:

Update to 1.20.4 (bnc#1206346): - CVE-2023-24539: Fixed an improper sanitization of CSS values (boo#1211029). - CVE-2023-24540: Fixed an improper handling of JavaScript whitespace (boo#1211030). - CVE-2023-29400: Fixed an improper handling of empty HTML attributes (boo#1211031). - runtime: automatically bump RLIMIT_NOFILE on Unix. - crypto/subtle: xor fails when run with race+purego. - cmd/compile: encoding/binary.PutUint16 sometimes doesn't write. - cmd/compile: internal compiler error: cannot call SetType(go.shape.int) on v (type int). - cmd/compile: miscompilation in star-tex.org/x/cmd/star-tex. - net/http: FileServer no longer serves content for POST. - crypto/tls: TLSv1.3 connection fails with invalid PSK binder. - cmd/compile: incorrect inline function variable. - cmd/compile: Unified IR exports table is binary unstable in presence of generics. - go/internal/gcimporter: lookupGorootExport should use the go command from build.Default.GOROOT.

Non-security fixes:

  • Reverted go1.x Suggests go1.x-race (boo#1210963).
  • Re-enabled binary stripping and debuginfo (boo#1210938).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • openSUSE Leap 15.4
    zypper in -t patch openSUSE-SLE-15.4-2023-2105=1
  • Development Tools Module 15-SP4
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-2105=1

Package List:

  • openSUSE Leap 15.4 (ppc64le s390x x86_64)
    • go1.20-1.20.4-150000.1.11.1
  • openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
    • go1.20-doc-1.20.4-150000.1.11.1
  • openSUSE Leap 15.4 (aarch64 x86_64)
    • go1.20-race-1.20.4-150000.1.11.1
  • Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64)
    • go1.20-doc-1.20.4-150000.1.11.1
    • go1.20-1.20.4-150000.1.11.1
  • Development Tools Module 15-SP4 (aarch64 x86_64)
    • go1.20-race-1.20.4-150000.1.11.1

References: