A Go security update has been released for Ubuntu Linux 22.10 and 23.04.

[USN-6140-1] Go vulnerabilities

==========================================================================
Ubuntu Security Notice USN-6140-1
June 06, 2023

go vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.10

Summary:

Several security issues were fixed in Go.

Software Description:
- golang-1.19: Go programming language compiler - metapackage
- golang-1.20: Go programming language compiler - metapackage

Details:

It was discovered that Go did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a panic
resulting in a denial of service. This issue only affected golang-1.19 on
Ubuntu 22.10. (CVE-2022-41724, CVE-2023-24534, CVE-2023-24537)

It was discovered that Go did not properly validate the amount of memory
and disk files ReadForm can consume. An attacker could possibly use this
issue to cause a panic resulting in a denial of service. This issue only
affected golang-1.19 on Ubuntu 22.10. (CVE-2022-41725)

It was discovered that Go did not properly validate backticks (`) as
Javascript string delimiters, and did not escape them as expected. An
attacker could possibly use this issue to inject arbitrary Javascript code
into the Go template. This issue only affected golang-1.19 on Ubuntu 22.10.
(CVE-2023-24538)

It was discovered that Go did not properly validate the angle brackets in
CSS values. An attacker could possibly use this issue to inject arbitrary
CSS code. (CVE-2023-24539)

It was discovered that Go did not properly validate whitespace characters
in Javascript, and did not escape them as expected. An attacker could
possibly use this issue to inject arbitrary Javascript code into the Go
template. (CVE-2023-24540)

It was discovered that Go did not properly validate HTML attributes with
empty input. An attacker could possibly use this issue to inject arbitrary
HTML tags into the Go template. (CVE-2023-29400)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
golang-1.19 1.19.8-1ubuntu0.1
golang-1.19-go 1.19.8-1ubuntu0.1
golang-1.19-src 1.19.8-1ubuntu0.1
golang-1.20 1.20.3-1ubuntu0.1
golang-1.20-go 1.20.3-1ubuntu0.1
golang-1.20-src 1.20.3-1ubuntu0.1

Ubuntu 22.10:
golang-1.19 1.19.2-1ubuntu1.1
golang-1.19-go 1.19.2-1ubuntu1.1
golang-1.19-src 1.19.2-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6140-1
CVE-2022-41724, CVE-2022-41725, CVE-2023-24534, CVE-2023-24537,
CVE-2023-24538, CVE-2023-24539, CVE-2023-24540, CVE-2023-29400

Package Information:
https://launchpad.net/ubuntu/+source/golang-1.19/1.19.8-1ubuntu0.1
https://launchpad.net/ubuntu/+source/golang-1.20/1.20.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/golang-1.19/1.19.2-1ubuntu1.1