Bug 30964

Summary: golang new security issues CVE-2022-2879, CVE-2022-2880, CVE-2022-41715
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: major    
Priority: Normal CC: andrewsfarm, bruno, davidwhodgins, sysadmin-bugs, tarazed25
Version: 8Keywords: advisory, validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: MGA8-64-OK
Source RPM: golang-1.19.1-1.mga9.src.rpm CVE:
Status comment:

Description David Walser 2022-10-14 19:53:04 CEST 
Go 1.18.7 and 1.19.2 have been released on October 4, fixing security issues:
https://groups.google.com/g/golang-announce/c/xtuG5faxtaU

Fedora has issued an advisory for this today (October 14):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SWGSHGPO6S5363G5FSISXYXICE3YJRKU/

Mageia 8 is also affected.
David Walser 2022-10-14 19:53:19 CEST

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 1.18.7 and 1.19.2

Comment 1 Bruno Cornec 2022-10-15 17:19:15 CEST 
1.19.2 on its way for cauldron

CC: (none) => bruno

Comment 2 Bruno Cornec 2022-10-15 17:36:05 CEST 
1.18.7 on its way for mag8 in updates_testing.

SRPMS/golang-1.18.7-1.mga8.src.rpm
RPMS/noarch/golang-docs-1.18.7-1.mga8.noarch.rpm
RPMS/noarch/golang-misc-1.18.7-1.mga8.noarch.rpm
RPMS/x86_64/golang-1.18.7-1.mga8.x86_64.rpm
RPMS/noarch/golang-tests-1.18.7-1.mga8.noarch.rpm
RPMS/noarch/golang-src-1.18.7-1.mga8.noarch.rpm
RPMS/x86_64/golang-race-1.18.7-1.mga8.x86_64.rpm
RPMS/x86_64/golang-shared-1.18.7-1.mga8.x86_64.rpm
RPMS/x86_64/golang-bin-1.18.7-1.mga8.x86_64.rpm

Version: Cauldron => 8
Whiteboard: MGA8TOO => (none)
Status: NEW => ASSIGNED
Status comment: Fixed upstream in 1.18.7 and 1.19.2 => (none)
Assignee: bruno => qa-bugs

Comment 3 Len Lawrence 2022-10-16 23:15:07 CEST 
mga8, x86_64

Noted the new package golang-race.  Smooth update.
Successful local build of the current docker packages.

CC: (none) => tarazed25
Whiteboard: (none) => MGA8-64-OK

Comment 4 Thomas Andrews 2022-10-17 02:31:24 CEST 
Validating

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Dave Hodgins 2022-10-18 23:40:37 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 6 Mageia Robot 2022-10-19 01:16:33 CEST 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0377.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED