[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2022-41717 affects golang-golang-x-net as well

[Shengjing Zhu (@zhsj)]

Shengjing Zhu pushed to branch master at Debian Security Tracker / security-tracker


Commits:
27e1419b by Shengjing Zhu at 2023-04-14T15:31:49+08:00
CVE-2022-41717 affects golang-golang-x-net as well

- - - - -
7a17025f by Shengjing Zhu at 2023-04-14T15:31:50+08:00
CVE-2022-41720/go affects cross compile for Windows binary

See 29f7d181bd88e363de11541667af407043579f00 as well

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -47319,12 +47319,13 @@ CVE-2022-41721 (A request smuggling attack is possible when using MaxBytesHandle
 	NOTE: Fixed in https://go.googlesource.com/net/+/702349b0e8628371f0e5ba0c10407448d60a67b1 (v0.2.0)
 	NOTE: Introduced in https://go.googlesource.com/net/+/1d687d428aca0546c0ca84160c8700ee521e9fb9 (v0.1.0)
 CVE-2022-41720 (On Windows, restricted files can be accessed via os.DirFS and http.Dir ...)
-	- golang-1.19 <not-affected> (Only affects Go on Windows)
-	- golang-1.18 <not-affected> (Only affects Go on Windows)
-	- golang-1.15 <not-affected> (Only affects Go on Windows)
-	- golang-1.11 <not-affected> (Only affects Go on Windows)
+	- golang-1.19 1.19.4-1 (unimportant)
+	- golang-1.18 1.18.9-1 (unimportant)
+	- golang-1.15 <removed> (unimportant)
+	- golang-1.11 <removed> (unimportant)
 	NOTE: https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU
 	NOTE: https://go.dev/issue/56694
+	NOTE: Only affects code cross compiled on Debian for Windows binaries
 CVE-2022-41719 (Unmarshal can panic on some inputs, possibly allowing for denial of se ...)
 	NOT-FOR-US: shamaton/msgpack
 CVE-2022-41718
@@ -47334,10 +47335,13 @@ CVE-2022-41717 (An attacker can cause excessive memory growth in a Go server acc
 	- golang-1.18 1.18.9-1
 	- golang-1.15 <removed>
 	- golang-1.11 <removed>
+	- golang-golang-x-net <1:0.4.0+dfsg-1>
+	- golang-golang-x-net-dev <removed>
 	NOTE: https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU
 	NOTE: https://go.dev/issue/56350
 	NOTE: https://github.com/golang/go/commit/618120c165669c00a1606505defea6ca755cdc27 (go1.19.4)
 	NOTE: https://github.com/golang/go/commit/76cad4edc29d28432a7a0aa27e87385d3d7db7a1 (go1.18.9)
+	NOTE: https://github.com/golang/net/commit/1e63c2f08a10a150fa02c50ece89b340ae64efe4
 CVE-2022-41716 (Due to unsanitized NUL values, attackers may be able to maliciously se ...)
 	- golang-1.19 <not-affected> (Only affects Go on Windows)
 	- golang-1.18 <not-affected> (Only affects Go on Windows)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/d04a648f5c2c49f0ecf9d049ec9b136058798e06...7a17025f958e6d71fc4ed28d472f026803278de9

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/d04a648f5c2c49f0ecf9d049ec9b136058798e06...7a17025f958e6d71fc4ed28d472f026803278de9
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230414/f1015b15/attachment-0001.htm>