A golang-1.8 security update has been released for Debian GNU/Linux 9 LTS to address several vulnerabilities.

DLA 2891-1: golang-1.8 security update

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2891-1 debian-lts@lists.debian.org
  https://www.debian.org/lts/security/ Sylvain Beucler
January 21, 2022   https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : golang-1.8
Version : 1.8.1-1+deb9u4
CVE ID : CVE-2021-33196 CVE-2021-36221 CVE-2021-39293 CVE-2021-41771
CVE-2021-44716 CVE-2021-44717
Debian Bug : 989492 991961

Several vulnerabilities were discovered in the Go programming
language. An attacker could trigger a denial-of-service (DoS) and
information leak.

CVE-2021-33196

In archive/zip, a crafted file count (in an archive's header) can
cause a NewReader or OpenReader panic.

CVE-2021-36221

Go has a race condition that can lead to a net/http/httputil
ReverseProxy panic upon an ErrAbortHandler abort.

CVE-2021-39293

Follow-up fix to CVE-2021-33196

CVE-2021-41771

ImportedSymbols in debug/macho (for Open or OpenFat) accesses a
Memory Location After the End of a Buffer, aka an out-of-bounds
slice situation.

CVE-2021-44716

net/http allows uncontrolled memory consumption in the header
canonicalization cache via HTTP/2 requests.

CVE-2021-44717

Go on UNIX allows write operations to an unintended file or
unintended network connection as a consequence of erroneous
closing of file descriptor 0 after file-descriptor exhaustion.

For Debian 9 stretch, these problems have been fixed in version
1.8.1-1+deb9u4.

We recommend that you upgrade your golang-1.8 packages.

For the detailed security status of golang-1.8 please refer to
its security tracker page at:
  https://security-tracker.debian.org/tracker/golang-1.8

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS