Go: Multiple vulnerabilities — GLSA 201812-09

Multiple vulnerabilities have been found in Go, the worst which could lead to the execution of arbitrary code.

Affected Packages

dev-lang/go on all architectures
Affected versions < 1.10.7
Unaffected versions >= 1.10.7

Background

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Description

Multiple vulnerabilities have been discovered in Go. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could cause arbitrary code execution by passing specially crafted Go packages the ‘go get -u’ command.

The remote attacker could also craft pathological inputs causing a CPU based Denial of Service condition via the crypto/x509 package.

Workaround

There is no known workaround at this time.

Resolution

All Go users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-lang/go-1.10.7"
 

References

Release Date
December 21, 2018

Latest Revision
December 21, 2018: 1

Severity
normal

Exploitable
remote

Bugzilla entries