USN-7081-1: Go vulnerabilities

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• golang-1.22 - Go programming language compiler

Details

It was discovered that the Go net/http module did not properly handle
responses to requests with an "Expect: 100-continue" header under certain
circumstances. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-24791)

It was discovered that the Go parser module did not properly handle deeply
nested literal values. An attacker could possibly use this issue to cause
a panic resulting in a denial of service. (CVE-2024-34155)

It was discovered that the Go encoding/gob module did not properly handle
message decoding under certain circumstances. An attacker could possibly
use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34156)

It was discovered that the Go build module did not properly handle certain
build tag lines with deeply nested expressions. An attacker could possibly
use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34158)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• golang-1.22 - 1.22.2-2ubuntu0.3
• golang-1.22-go - 1.22.2-2ubuntu0.3
• golang-1.22-src - 1.22.2-2ubuntu0.3

Ubuntu 22.04

• golang-1.22 - 1.22.2-2~22.04.2
• golang-1.22-go - 1.22.2-2~22.04.2
• golang-1.22-src - 1.22.2-2~22.04.2

Ubuntu 20.04

• golang-1.22 - 1.22.2-2~20.04.2
• golang-1.22-go - 1.22.2-2~20.04.2
• golang-1.22-src - 1.22.2-2~20.04.2

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-34158
• CVE-2024-34155
• CVE-2024-24791
• CVE-2024-34156

Related notices

• USN-7111-1: golang-1.17-src, golang-1.17-doc, golang-1.17-go, golang-1.17
• USN-7109-1: golang-1.18, golang-1.18-go, golang-1.18-src, golang-1.18-doc