[pkg-golang-devel] Bug#874783: Update golang-1.8 in stable

[Wouter Van Hemel]

Package: golang-1.8-src
Source: golang-1.8
Version: 1.8.1-1


Hello,

Is there going to be an update to golang-1.8 in Debian stable? The current version 1.8.1 has a security issue (CVE-2017-8932) that might be relevant to some users using e.g. JWT libraries or other code that depends on elliptic curve cryptography. I use 1.8 with such code, but I haven't gone full-depth to check whether I'm affected by the specific code path of this bug.

Backports seems to have 1.8.3. Are we suppose to switch to backports for updates instead?

Thanks!