From 588ffa833553fa6c448742a231b3fbfe3dc5b56a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrian=20Schr=C3=B6ter?= Date: Tue, 5 Nov 2024 13:45:18 +0100 Subject: [PATCH] Adding patchinfo patchinfo.20241104100820674902.269002615871826 --- .gitmodules | 9 +++ go1.22-openssl | 1 + go1.23-openssl | 1 + govulncheck-vulndb | 1 + .../_patchinfo | 57 +++++++++++++++++++ 5 files changed, 69 insertions(+) create mode 160000 go1.22-openssl create mode 160000 go1.23-openssl create mode 160000 govulncheck-vulndb create mode 100644 patchinfo.20241104100820674902.269002615871826/_patchinfo diff --git a/.gitmodules b/.gitmodules index 196f2f7..36198f1 100644 --- a/.gitmodules +++ b/.gitmodules @@ -9140,3 +9140,12 @@ [submodule "govulncheck"] path = govulncheck url = ../../ALP-pool/govulncheck +[submodule "go1.22-openssl"] + path = go1.22-openssl + url = ../../ALP-pool/go1.22-openssl +[submodule "go1.23-openssl"] + path = go1.23-openssl + url = ../../ALP-pool/go1.23-openssl +[submodule "govulncheck-vulndb"] + path = govulncheck-vulndb + url = ../../ALP-pool/govulncheck-vulndb diff --git a/go1.22-openssl b/go1.22-openssl new file mode 160000 index 0000000..6397b8f --- /dev/null +++ b/go1.22-openssl @@ -0,0 +1 @@ +Subproject commit 6397b8f09022615dc4103b17a4b2a9f471148e60 diff --git a/go1.23-openssl b/go1.23-openssl new file mode 160000 index 0000000..84224a3 --- /dev/null +++ b/go1.23-openssl @@ -0,0 +1 @@ +Subproject commit 84224a3effc89d77dd6a48fe3be67b523c652782 diff --git a/govulncheck-vulndb b/govulncheck-vulndb new file mode 160000 index 0000000..296d2ac --- /dev/null +++ b/govulncheck-vulndb @@ -0,0 +1 @@ +Subproject commit 296d2acfe9c73c06f4fef80a09654ea34bd10361 diff --git a/patchinfo.20241104100820674902.269002615871826/_patchinfo b/patchinfo.20241104100820674902.269002615871826/_patchinfo new file mode 100644 index 0000000..6d216f6 --- /dev/null +++ b/patchinfo.20241104100820674902.269002615871826/_patchinfo @@ -0,0 +1,57 @@ + + + go1.21 release tracking + go1.22 release tracking + go1.23 release tracking + go1.20,go1.21,go1.22: ensure VERSION file is present in go1.x toolchain GOROOT + VUL-0: CVE-2024-24783 go1.21,go1.22: crypto/x509: Verify panics on certificates with an unknown public key algorithm + VUL-0: CVE-2023-45289 go1.21,go1.22: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect + VUL-0: CVE-2023-45290 go1.21,go1.22: net/http: memory exhaustion in Request.ParseMultipartForm + VUL-0: CVE-2024-24784 go1.21,go1.22: net/mail: comments in display names are incorrectly handled + VUL-0: CVE-2024-24785 go1.21,go1.22: html/template: errors returned from MarshalJSON methods may break template escaping + VUL-0: CVE-2023-45288: go1.21,go1.22: net/http, x/net/http2: close connections when receiving too many headers + VUL-0: CVE-2024-24787: go1.21,go1.22: cmd/go: arbitrary code execution during build on darwin + VUL-0: CVE-2024-24788: go1.22: net: malformed DNS message can cause infinite loop + VUL-0: CVE-2024-24789: go1.21,go1.22: archive/zip: mishandling of corrupt central directory record + VUL-0: CVE-2024-24790: go1.21,go1.22: net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses + VUL-0: CVE-2024-24791 go1.21,go1.22: net/http: denial of service due to improper 100-continue handling + VUL-0: CVE-2024-34155: go1.22,go1.23: go/parser: stack exhaustion in all Parse* functions + VUL-0: CVE-2024-34156: go1.22,go1.23: encoding/gob: stack exhaustion in Decoder.Decode + VUL-0: CVE-2024-34158: go1.22,go1.23: go/build/constraint: stack exhaustion in Parse + + + + + + + + + + + + + + + + + jfkw + moderate + security + Security update for go1.23-openssl, go1.21-openssl, go1.22-openssl + This update for go1.23-openssl, go1.21-openssl, go1.22-openssl fixes the following issues: + +go1.21-openssl: + - Update to version 1.21.13.4 cut from the go1.21-fips-release + +go1.22-openssl: + - Update to version 1.22.7.1 cut from the go1.22-fips-release + +go1.23-openssl: + - Update to version 1.23.2.2 cut from the go1.23-fips-release + + + go1.21-openssl + go1.22-openssl + go1.23-openssl + +