SUSE-SU-2023:2526-1
Security update for go1.20
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for go1.20 fixes the following issues: Update to go1.20.5 (bsc#1206346): - CVE-2023-29402: cmd/go: Fixed cgo code injection (bsc#1212073). - CVE-2023-29403: runtime: Fixed unexpected behavior of setuid/setgid binaries (bsc#1212074). - CVE-2023-29404: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212075). - CVE-2023-29405: cmd/go: Fixed improper sanitization of LDFLAGS (bsc#1212076).
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 15.4 | go1.20, go1.20-doc, go1.20-race | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.5 | go1.20, go1.20-doc, go1.20-race | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.3 | go1.20, go1.20-doc, go1.20-race | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.4 | go1.20, go1.20-doc, go1.20-race | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.5 | go1.20, go1.20-doc, go1.20-race | 1.20.5-150000.1.14.1 |
Show all 15 entries from 5 sources
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 15.4 | go1.20 | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.4 | go1.20-doc | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.4 | go1.20-race | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.5 | go1.20 | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.5 | go1.20-doc | 1.20.5-150000.1.14.1 |
| openSUSE Leap 15.5 | go1.20-race | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.3 | go1.20 | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.3 | go1.20-doc | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.3 | go1.20-race | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.4 | go1.20 | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.4 | go1.20-doc | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.4 | go1.20-race | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.5 | go1.20 | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.5 | go1.20-doc | 1.20.5-150000.1.14.1 |
| SUSE Linux Enterprise 15.5 | go1.20-race | 1.20.5-150000.1.14.1 |
References
- https://bugzilla.suse.com/1206346
- https://bugzilla.suse.com/1212073
- https://bugzilla.suse.com/1212074
- https://bugzilla.suse.com/1212075
- https://bugzilla.suse.com/1212076
- https://lists.suse.com/pipermail/sle-security-updates/2023-June/015222.html
- https://www.suse.com/security/cve/CVE-2023-29402/
- https://www.suse.com/security/cve/CVE-2023-29403/