Bug 29391 - golang new security issue CVE-2021-36221
Summary: golang new security issue CVE-2021-36221
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-08-20 17:40 CEST by David Walser
Modified: 2021-09-04 19:03 CEST (History)
5 users (show)

See Also:
Source RPM: golang-1.15.14-1.mga8.src.rpm
CVE: CVE-2021-36221
Status comment:


Attachments

Description David Walser 2021-08-20 17:40:38 CEST
SUSE has issued an advisory today (August 20):
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009314.html

The issue is fixed upstream in 1.15.15 and 1.16.7:
https://groups.google.com/g/golang-announce/c/uHACNfXAZqk

Mageia 8 is also affected.
David Walser 2021-08-20 17:41:23 CEST

Status comment: (none) => Fixed upstream in 1.15.15 and 1.16.7
CC: (none) => nicolas.salguero
Whiteboard: (none) => MGA8TOO

Comment 1 David Walser 2021-08-20 17:43:01 CEST
SUSE advisory for 1.15.15:
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009321.html
Comment 3 Lewis Smith 2021-08-20 21:31:33 CEST
Various people commit 'golang', so assigning globally; a couple of the most relevant are CC'd.

Assignee: bugsquad => pkg-bugs
CC: (none) => joequant

Comment 4 Nicolas Salguero 2021-08-30 16:48:18 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36221
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009314.html
https://groups.google.com/g/golang-announce/c/uHACNfXAZqk
https://lists.suse.com/pipermail/sle-security-updates/2021-August/009321.html
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QBLRS3I4ZUSJEMER3J6HA6RD4XDIQYHC/
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7FPUQARVFSVTNWXPM6OPHZLDEEMVSSM3/
========================

Updated packages in core/updates_testing:
========================
golang-docs-1.15.15-1.mga8
golang-misc-1.15.15-1.mga8
golang-1.15.15-1.mga8
golang-tests-1.15.15-1.mga8
golang-src-1.15.15-1.mga8
golang-shared-1.15.15-1.mga8
golang-bin-1.15.15-1.mga8

from SRPM:
golang-1.15.15-1.mga8.src.rpm

CVE: (none) => CVE-2021-36221
Assignee: pkg-bugs => qa-bugs
Status comment: Fixed upstream in 1.15.15 and 1.16.7 => (none)
Version: Cauldron => 8
Status: NEW => ASSIGNED
Whiteboard: MGA8TOO => (none)

Comment 5 Len Lawrence 2021-08-30 23:59:38 CEST
mga8, x86

Could not find a specific reproducer for the issue in CVE-202136221 so went ahead with the updates.
Built docker to test golang capabilities, our traditional test.
$ mgarepo co docker
$ cd docker
$ ll
total 8
drwxr-xr-x 2 lcl lcl 4096 Aug 30 22:45 SOURCES/
drwxr-xr-x 2 lcl lcl 4096 Aug 30 22:45 SPECS/
$ bm -ls
creating package list
processing package %{origname}-%{moby_version}-%mkrel 1
building source package
warning: Macro expanded in comment on line 40: %{shortcommit_moby}
warning: line 115: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-swarm
warning: line 117: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-vim
Wrote: /home/lcl/go/golang/docker/SRPMS/docker-20.10.5-1.mga8.src.rpm
succeeded!
$ ls
BUILD/  BUILDROOT/  RPMS/  SOURCES/  SPECS/  SRPMS/
$ sudo urpmi --buildrequires SPECS/docker.spec
.............
Proceed with the installation of the 48 packages? (Y/n)
$ bm
creating package list
processing package %{origname}-%{moby_version}-%mkrel 1
building source and binary packages
<3 minute wait - 2 cores running flat out>
succeeded!
$ cd RPMS/x86_64
$ ll
total 74104
-rw-r--r-- 1 lcl lcl 36386250 Aug 30 22:54 docker-20.10.5-1.mga8.x86_64.rpm
-rw-r--r-- 1 lcl lcl 39430606 Aug 30 22:54 docker-devel-20.10.5-1.mga8.x86_64.rpm
-rw-r--r-- 1 lcl lcl    14607 Aug 30 22:53 docker-fish-completion-20.10.5-1.mga8.x86_64.rpm
-rw-r--r-- 1 lcl lcl     7555 Aug 30 22:53 docker-logrotate-20.10.5-1.mga8.x86_64.rpm
-rw-r--r-- 1 lcl lcl     7151 Aug 30 22:53 docker-nano-20.10.5-1.mga8.x86_64.rpm
-rw-r--r-- 1 lcl lcl    25317 Aug 30 22:53 docker-zsh-completion-20.10.5-1.mga8.x86_64.rpm

OK for x86_64.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => tarazed25

Comment 6 Thomas Andrews 2021-09-01 20:04:47 CEST
Validating. Advisory in Comment 4.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2021-09-04 18:01:44 CEST

Keywords: (none) => advisory

Comment 7 Mageia Robot 2021-09-04 19:03:32 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0416.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.