From nobody Wed Aug 2 13:30:06 2023 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RGCXF6JnJz4qbML; Wed, 2 Aug 2023 13:30:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RGCWz5MFdz3jqt; Wed, 2 Aug 2023 13:30:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1690983007; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6IiFnBEvVfZDlsZBiNcASnLwobXv8kAkF74L3wQ6H70=; b=EhwiPedt5v5ZpfdCYfA78xq2wZWXR/ArIaXdQ2fMoajOMagLuRzLXmiJ4eNIHsbhPmQtyC 1GtKAoFdVgByZw8VRuyG2NLXV2qLfLfJpmzWFoO6NaChLwmNJgJUvFz0V8k6SuN9SMkRHg N5ClHUDHAB4unHjOftshoPki9ZvXmGGxEdq2JbworHh0a4nfg4fXXzYDdHnzP/zMcMdfik 9UaiUYrcXIWKsHE1qZp+magmj+Lm2YGLsxWDlOHrnt/7VQ691P1fL9d+NyG/Uv3SIup9uQ sWQxcGSa3jc1BBo1syLOqU2oeRxm9KTNAXRCC5Fqswv+l8nJqxZIPOcj6nn40g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1690983007; a=rsa-sha256; cv=none; b=u3hO9S9TyOykSVp9DbKGJIg+XGRYpf1eMMEdf9xhTo5zil3MIQwbwE8zIPiBA34v6XYlN2 rHoSRR+7zxex3jCC3AXdUM+bJg3cWMOFZu2UZJ5J//XhmYhrgMA3ypL6Iub1cwfXfnyM0I sqBSSfomKKfc+gN4YkZPMMw19JQc3MTgfRD7aHjW9GokV17GQdzKzvbY6zi2m7ki0koruQ EjVMF/GuRqogV5nUr3/17HCq00T4nR7Jz9HijDP33hsr7e0Xe5Yto9mTcR3jfAsnviQ5Py /VY3ntiUqDKcsulZ1xEiXvFatENG770Vv71agHxxubmje8Vil01IKuj40t8cmg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1690983007; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=6IiFnBEvVfZDlsZBiNcASnLwobXv8kAkF74L3wQ6H70=; b=NPXzlQ04Ap2bRlfXvr4p+dYx60FTooYDv6hn4V6v3Q3x6aElKE+Q8pwQTm93FtDJkRmizU 5ewp4px/rvO6DKs/lizfdeyWHKmhjnY5DcFF2iju9/BUFhyiDkkcDuUwbsXunAYBHiu2ln BZmB/BO74FxNBWsLrwca6mc9zhqAGoEFJU7ok7lrf2W1fqlfTWA1l9P+STjY8SXzkV6FkR c8kQwbpVz/0OWZOiwg3JmUgYazv5QBdKNYgkDoVBbUb5PStW/xU8GdcnkcftifDMy2hA1I vRglo3SnPPiYa+7EvTmGuLJX1NpHfTxikKuaqE15g50aUrBYN3pWy5oHfoT6bw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RGCWz39rbzLg1; Wed, 2 Aug 2023 13:30:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 372DU617041206; Wed, 2 Aug 2023 13:30:06 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 372DU6lf041202; Wed, 2 Aug 2023 13:30:06 GMT (envelope-from git) Date: Wed, 2 Aug 2023 13:30:06 GMT Message-Id: <202308021330.372DU6lf041202@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Dmitri Goutnik Subject: git: 3062adea71ee - main - security/vuxml: Document Go vulnerabilities List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dmgk X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3062adea71eeab51c1df67041a7ff98ddd1ba558 Auto-Submitted: auto-generated The branch main has been updated by dmgk: URL: https://cgit.FreeBSD.org/ports/commit/?id=3062adea71eeab51c1df67041a7ff98ddd1ba558 commit 3062adea71eeab51c1df67041a7ff98ddd1ba558 Author: Dmitri Goutnik AuthorDate: 2023-08-02 13:26:13 +0000 Commit: Dmitri Goutnik CommitDate: 2023-08-02 13:27:53 +0000 security/vuxml: Document Go vulnerabilities --- security/vuxml/vuln/2023.xml | 105 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 53897f30e535..cb9702c09400 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,108 @@ + + go -- multiple vulnerabilities + + + go119 + 1.19.12 + + + go120 + 1.20.7 + + + + +

The Go project reports:

+
+

crypto/tls: restrict RSA keys in certificates to <= 8192 bits

+

Extremely large RSA keys in certificate chains can cause + a client/server to expend significant CPU time verifying + signatures. Limit this by restricting the size of RSA keys + transmitted during handshakes to <= 8192 bits.

+
+
+

net/http: insufficient sanitization of Host header

+

The HTTP/1 client did not fully validate the contents of + the Host header. A maliciously crafted Host header could + inject additional headers or entire requests. The HTTP/1 + client now refuses to send requests containing an + invalid Request.Host or Request.URL.Host value.

+
+
+

cmd/go: cgo code injection

+

The go command may generate unexpected code at build + time when using cgo. This may result in unexpected + behavior when running a go program which uses cgo.

+
+
+

runtime: unexpected behavior of setuid/setgid binaries

+

The Go runtime didn't act any differently when a binary + had the setuid/setgid bit set. On Unix platforms, if a + setuid/setgid binary was executed with standard I/O file + descriptors closed, opening any files could result in + unexpected content being read/written with elevated + prilieges. Similarly if a setuid/setgid program was + terminated, either via panic or signal, it could leak the + contents of its registers.

+
+
+

cmd/go: improper sanitization of LDFLAGS

+

The go command may execute arbitrary code at build time + when using cgo. This may occur when running "go get" on a + malicious module, or when running any other command which + builds untrusted code. This is can by triggered by linker + flags, specified via a "#cgo LDFLAGS" directive.

+
+
+

html/template: improper sanitization of CSS values

+

+ Angle brackets (<>) were not considered dangerous + characters when inserted into CSS contexts. Templates + containing multiple actions separated by a '/' character + could result in unexpectedly closing the CSS context and + allowing for injection of unexpected HMTL, if executed + with untrusted input.

+
+
+

html/template: improper handling of JavaScript whitespace

+

+ Not all valid JavaScript whitespace characters were + considered to be whitespace. Templates containing + whitespace characters outside of the character set + "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that + also contain actions may not be properly sanitized + during execution.

+
+
+

html/template: improper handling of empty HTML attributes

+

+ Templates containing actions in unquoted HTML attributes + (e.g. "attr={{.}}") executed with empty input could + result in output that would have unexpected results when + parsed due to HTML normalization rules. This may allow + injection of arbitrary attributes into tags.

+
+ + + + CVE-2023-29406 + CVE-2023-29402 + CVE-2023-29403 + CVE-2023-29404 + CVE-2023-24539 + CVE-2023-24540 + CVE-2023-29400 + https://groups.google.com/u/1/g/golang-announce/c/X0b6CsSAaYI + https://groups.google.com/u/1/g/golang-announce/c/2q13H6LEEx0 + https://groups.google.com/u/1/g/golang-announce/c/q5135a9d924 + https://groups.google.com/u/1/g/golang-announce/c/MEb0UyuSMsU + + + 2023-04-27 + 2023-08-02 + + + Gitlab -- Vulnerabilities