--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2022-246382d5dc
2022-01-29 15:01:36.424232
--------------------------------------------------------------------------------
Name : golang
Product : Fedora EPEL 7
Version : 1.16.13
Release : 2.el7
URL :
http://golang.org/
Summary : The Go Programming Language
Description :
The Go Programming Language.
--------------------------------------------------------------------------------
Update Information:
Update to go1.16.13, Security fix for CVE-2021-44716, CVE-2021-41772,
CVE-2021-41771, CVE-2021-38297, CVE-2021-39293, CVE-2021-39293, CVE-2021-36221,
CVE-2021-44717
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jan 20 2022 Dave Dykstra <dwd(a)fedoraproject.org> - 1.16.13-2
- Add back providing go-srpm-macros on rhel 7
* Tue Jan 18 2022 Dave Dykstra <dwd(a)fedoraproject.org> - 1.16.13-1
- Update to go1.16.13, copied from f35
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of
persistConn after handler panic
https://bugzilla.redhat.com/show_bug.cgi?id=1995656
[ 2 ] Bug #2006044 - CVE-2021-39293 golang: archive/zip: malformed archive may cause
panic or memory exhaustion (incomplete fix of CVE-2021-33196)
https://bugzilla.redhat.com/show_bug.cgi?id=2006044
[ 3 ] Bug #2012887 - CVE-2021-38297 golang: Command-line arguments may overwrite global
data
https://bugzilla.redhat.com/show_bug.cgi?id=2012887
[ 4 ] Bug #2020725 - CVE-2021-41771 golang: debug/macho: invalid dynamic symbol table
command can cause panic
https://bugzilla.redhat.com/show_bug.cgi?id=2020725
[ 5 ] Bug #2020736 - CVE-2021-41772 golang: archive/zip: Reader.Open panics on empty
string
https://bugzilla.redhat.com/show_bug.cgi?id=2020736
[ 6 ] Bug #2030801 - CVE-2021-44716 golang: net/http: limit growth of header
canonicalization cache
https://bugzilla.redhat.com/show_bug.cgi?id=2030801
[ 7 ] Bug #2030806 - CVE-2021-44717 golang: syscall: don't close fd 0 on ForkExec
error
https://bugzilla.redhat.com/show_bug.cgi?id=2030806
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update golang' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------