USN-6140-1: Go vulnerabilities

Releases

• Ubuntu 23.04
• Ubuntu 22.10

Packages

• golang-1.19 - Go programming language compiler - metapackage
• golang-1.20 - Go programming language compiler - metapackage

Details

It was discovered that Go did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a panic
resulting in a denial of service. This issue only affected golang-1.19 on
Ubuntu 22.10. (CVE-2022-41724, CVE-2023-24534, CVE-2023-24537)

It was discovered that Go did not properly validate the amount of memory
and disk files ReadForm can consume. An attacker could possibly use this
issue to cause a panic resulting in a denial of service. This issue only
affected golang-1.19 on Ubuntu 22.10. (CVE-2022-41725)

It was discovered that Go did not properly validate backticks (`) as
Javascript string delimiters, and did not escape them as expected. An
attacker could possibly use this issue to inject arbitrary Javascript code
into the Go template. This issue only affected golang-1.19 on Ubuntu 22.10.
(CVE-2023-24538)

It was discovered that Go did not properly validate the angle brackets in
CSS values. An attacker could possibly use this issue to inject arbitrary
CSS code. (CVE-2023-24539)

It was discovered that Go did not properly validate whitespace characters
in Javascript, and did not escape them as expected. An attacker could
possibly use this issue to inject arbitrary Javascript code into the Go
template. (CVE-2023-24540)

It was discovered that Go did not properly validate HTML attributes with
empty input. An attacker could possibly use this issue to inject arbitrary
HTML tags into the Go template. (CVE-2023-29400)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• golang-1.19-go - 1.19.8-1ubuntu0.1
• golang-1.19-src - 1.19.8-1ubuntu0.1
• golang-1.20-go - 1.20.3-1ubuntu0.1
• golang-1.20 - 1.20.3-1ubuntu0.1
• golang-1.19 - 1.19.8-1ubuntu0.1
• golang-1.20-src - 1.20.3-1ubuntu0.1

Ubuntu 22.10

• golang-1.19-src - 1.19.2-1ubuntu1.1
• golang-1.19-go - 1.19.2-1ubuntu1.1
• golang-1.19 - 1.19.2-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-29400
• CVE-2023-24534
• CVE-2022-41725
• CVE-2023-24539
• CVE-2023-24538
• CVE-2023-24540
• CVE-2023-24537
• CVE-2022-41724

Related notices

• USN-6038-1: golang-1.18, golang-1.18-go, golang-1.18-doc, golang-1.18-src
• USN-6038-2: golang-1.13-src, golang-1.13, golang-1.16-src, golang-1.16, golang-1.16-doc, golang-1.16-go, golang-1.13-doc, golang-1.13-go