摘要:
golang security update
安全等级: High
公告ID: KylinSec-SA-2024-3157
发布日期: 2024年3月22日
关联CVE: CVE-2023-45289 CVE-2023-45290 CVE-2024-24783 CVE-2024-24785
The Go Programming Language.
Security Fix(es):
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.(CVE-2023-45289)
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.(CVE-2023-45290)
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.(CVE-2024-24783)
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2023-45289 | KY3.4-5A | golang | Fixed |
| CVE-2023-45289 | KY3.5.2 | golang | Fixed |
| CVE-2023-45290 | KY3.4-5A | golang | Fixed |
| CVE-2023-45290 | KY3.5.2 | golang | Fixed |
| CVE-2024-24783 | KY3.4-5A | golang | Fixed |
| CVE-2024-24783 | KY3.5.2 | golang | Fixed |
| CVE-2024-24785 | KY3.4-5A | golang | Fixed |
| CVE-2024-24785 | KY3.5.2 | golang | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| golang-help | noarch | 1.15.7-43.kb1.ky3_4 |
| golang-devel | noarch | 1.15.7-43.kb1.ky3_4 |
| golang | x86_64 | 1.15.7-43.kb1.ky3_4 |
| golang | aarch64 | 1.15.7-43.kb1.ky3_4 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| golang-devel | noarch | 1.17.3-32.ky3_5.kb1 |
| golang-help | noarch | 1.17.3-32.ky3_5.kb1 |
| golang | x86_64 | 1.17.3-32.ky3_5.kb1 |
| golang | aarch64 | 1.17.3-32.ky3_5.kb1 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
