From ff7486eeb3eb92034f12206a5492d51346d78105 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adrian=20Schr=C3=B6ter?= Date: Fri, 7 Feb 2025 16:17:39 +0100 Subject: [PATCH] Adding patchinfo patchinfo.20250206145038257185.90520734224245 --- .gitmodules | 3 ++ go1.22 | 2 +- go1.23 | 2 +- go1.24 | 1 + .../_patchinfo | 33 +++++++++++++++++++ 5 files changed, 39 insertions(+), 2 deletions(-) create mode 160000 go1.24 create mode 100644 patchinfo.20250206145038257185.90520734224245/_patchinfo diff --git a/.gitmodules b/.gitmodules index 64c6c8f..0c7bb31 100644 --- a/.gitmodules +++ b/.gitmodules @@ -9170,3 +9170,6 @@ [submodule "opencl-headers"] path = opencl-headers url = ../../ALP-pool/opencl-headers +[submodule "go1.24"] + path = go1.24 + url = ../../ALP-pool/go1.24 diff --git a/go1.22 b/go1.22 index 0d6198a..00fd69e 160000 --- a/go1.22 +++ b/go1.22 @@ -1 +1 @@ -Subproject commit 0d6198a23ec71ae63dc98aeca3b94a637e2956f9 +Subproject commit 00fd69e6efafe4122732752dfd7f28a978d48f56 diff --git a/go1.23 b/go1.23 index ff7cf72..0deddbf 160000 --- a/go1.23 +++ b/go1.23 @@ -1 +1 @@ -Subproject commit ff7cf7244af4406766539327f051784e868e28e4 +Subproject commit 0deddbf57a07f6cc66c06f3ea1c0ba861b989cc5 diff --git a/go1.24 b/go1.24 new file mode 160000 index 0000000..abc823b --- /dev/null +++ b/go1.24 @@ -0,0 +1 @@ +Subproject commit abc823b62c0d719f3808fcb8331addf16f679515 diff --git a/patchinfo.20250206145038257185.90520734224245/_patchinfo b/patchinfo.20250206145038257185.90520734224245/_patchinfo new file mode 100644 index 0000000..9bbe360 --- /dev/null +++ b/patchinfo.20250206145038257185.90520734224245/_patchinfo @@ -0,0 +1,33 @@ + + + VUL-0: CVE-2024-45341: go1.22,go1.23: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints + VUL-0: CVE-2024-45336: go1.22,go1.23: net/http: sensitive headers incorrectly sent after cross-domain redirect + go1.24 release tracking + VUL-0: CVE-2024-45340: go1.24: cmd/go: GOAUTH credential leak + VUL-0: CVE-2025-22865: go1.24: crypto/x509: ParsePKCS1PrivateKey panic with partial keys + VUL-0: CVE-2025-22866 go1.22,go1.23,go1.24: crypto/elliptic: timing sidechannel for P-256 on ppc64le + VUL-0: CVE-2025-22867: go1.24: cmd/go: arbitrary code execution during build on darwin + + + + + + + jfkw + important + security + Security update for go1.24 + This update for go1.24 fixes the following issues: + +go1.24rc3 (released 2024-02-05) is a release candidate version of go1.24. (bsc#1236217) + +* CVE-2025-22866: crypto/internal/fips140/nistec: p256NegCond is variable time on ppc64le (bsc#1236801) +* CVE-2025-22867: cmd/go: arbitrary code execution during build on darwin (bsc#1236839) +* CVE-2024-45341: crypto/x509: properly check for IPv6 hosts in URIs (bsc#1236045) +* CVE-2024-45336: net/http: persist header stripping across repeated redirects (bsc#1236046) +* CVE-2025-22865: crypto/x509: avoid panic when parsing partial PKCS#1 private keys (bsc#1236361) +* CVE-2024-45340: cmd/go: restore netrc preferences for GOAUTH and fix domain lookup (bsc#1236360) + + go1.24 + +