A golang security update has been released for Debian GNU/Linux 8 Extended LTS to address several vulnerabilities.
ELA-547-1 golang security update
Several vulnerabilities were discovered in the Go programming language. An attacker could trigger denial-of-service (DoS) and information leak.
ELA-547-1 golang security update
CVE-2021-33196
In archive/zip, a crafted file count (in an archive’s header) can cause a NewReader or OpenReader panic.
CVE-2021-36221
Go has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
CVE-2021-39293
Follow-up fix to CVE-2021-33196
CVE-2021-41771
ImportedSymbols in debug/macho (for Open or OpenFat) accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
