ALT Linux Team

Package golang update in sisyphus on 2024-09-06

ALT-PU-2024-12196-1

Package golang updated to version 1.23.1-alt1 for branch sisyphus in task 356931.

Closed vulnerabilities

Published: 2024-09-07
Modified: 2024-11-21

CVE-2024-34155

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

References:
Published: 2024-09-07
Modified: 2024-11-21

CVE-2024-34156

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

References:
Published: 2024-09-07
Modified: 2024-11-21

CVE-2024-34158

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top