Bug 31158 - golang new security issue CVE-2022-41716
Summary: golang new security issue CVE-2022-41716
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2022-11-21 04:46 CET by David Walser
Modified: 2022-11-27 21:53 CET (History)
6 users (show)

See Also:
Source RPM: golang-1.18.7-1.mga8.src.rpm
CVE:
Status comment:


Attachments
Intermediate workfile .../BUILDROOT/rpm-tmp.BAIbW2 referenced in build log at exit. (7.73 KB, application/x-shellscript)
2022-11-23 00:12 CET, Len Lawrence
Details

Description David Walser 2022-11-21 04:46:55 CET
SUSE has issued advisories on November 17:
https://lists.suse.com/pipermail/sle-security-updates/2022-November/012970.html
https://lists.suse.com/pipermail/sle-security-updates/2022-November/012965.html

The issue is fixed upstream in 1.18.8 and 1.19.3:
https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM

Mageia 8 is also affected.
Comment 1 David Walser 2022-11-21 04:48:10 CET
It sounds like it may only affect Windows.

Whiteboard: (none) => MGA8TOO
Status comment: (none) => Fixed upstream in 1.18.8 and 1.19.3

Comment 3 Bruno Cornec 2022-11-21 21:08:43 CET
1.19.3 pushed to cauldron

Status: NEW => ASSIGNED

Comment 4 Bruno Cornec 2022-11-21 21:47:41 CET
1.18.8 pushed to mga8 updates_testing

Status comment: Fixed upstream in 1.18.8 and 1.19.3 => (none)
Version: Cauldron => 8
Assignee: bruno => qa-bugs

Comment 5 David Walser 2022-11-21 23:20:59 CET
golang-tests-1.18.8-1.mga8
golang-1.18.8-1.mga8
golang-misc-1.18.8-1.mga8
golang-docs-1.18.8-1.mga8
golang-src-1.18.8-1.mga8
golang-shared-1.18.8-1.mga8
golang-bin-1.18.8-1.mga8

from golang-1.18.8-1.mga8.src.rpm

CC: (none) => bruno
Whiteboard: MGA8TOO => (none)
Source RPM: golang-1.19.2-1.mga9.src.rpm, golang-1.18.7-1.mga8.src.rpm => golang-1.18.7-1.mga8.src.rpm

Comment 6 Len Lawrence 2022-11-22 19:46:10 CET
Mageia8, x86_64

Update of the golang packages ran smoothly but the rebuild of docker failed.  First time ever.

This is the tail of the session log:
c/usr/lib/golang/pkg/tool/linux_amd64/buildid -w $WORK/b2622/_pkg_.a # internal
/usr/lib/golang/pkg/tool/linux_amd64/buildid -w $WORK/b2517/_pkg_.a # internal
cp $WORK/b2517/_pkg_.a /home/lcl/.cache/go-build/a9/a9122a106a648524fca6a43278197646c119737ecccfe93d7555a44fecf1541c-d # internal
cp $WORK/b2622/_pkg_.a /home/lcl/.cache/go-build/c2/c256c28fbcaafcaebd496fc3540daaa271cc6cf473f99720a5cd6d8a151cc5b4-d # internal
/usr/lib/golang/pkg/tool/linux_amd64/buildid -w $WORK/b2518/_pkg_.a # internal
p $WORK/b2518/_pkg_.a /home/lcl/.cache/go-build/a8/a88d0336e506db15d51aaeb5422b59d3e579527e2fec739906fd8b3fdf69bf4d-d # internal
error: Bad exit status from /home/lcl/docker/BUILDROOT/rpm-tmp.BAIbW2 (%build)


RPM build errors:
    Macro expanded in comment on line 43: %{shortcommit_moby}

    line 120: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-swarm
    line 122: It's not recommended to have unversioned Obsoletes: Obsoletes: docker-vim
    Bad exit status from /home/lcl/docker/BUILDROOT/rpm-tmp.BAIbW2 (%build)

If the  whole log is needed it can be attached.

The message "It's not recommended to have unversioned Obsoletes" always occurs at the buildrequires stage as well - I always ignore it.

CC: (none) => tarazed25

Comment 7 Len Lawrence 2022-11-23 00:12:02 CET
Created attachment 13529 [details]
Intermediate workfile  .../BUILDROOT/rpm-tmp.BAIbW2 referenced in build log at exit.
Comment 8 Bruno Cornec 2022-11-23 00:25:58 CET
Yes, I have issues to build the latest Docker, but this is unrelated to the version of golang. Please try to build the current mga8 version, from the src.rpm, not the one in SVN which is still WIP as I've not got help from the ML on this issue you reported and that I encountered as well.
Comment 9 Len Lawrence 2022-11-23 10:20:33 CET
Thanks for the quick response.  This could be difficult because I know almost nothing about packaging and building from source.  I have the Donovan & Kernighan book so a simple programming project may be all we can hope for.
Comment 10 Herman Viaene 2022-11-23 13:56:35 CET
MGA8-64 MATE on Acer Aspire 5253
No installation issues
Tried to replicate my test from bug 30709 Comment 3 and get the same output and run into the same issue.
Looked for this zipdata.go file and found it indeed in /usr/lib/golang/src/time/tzdata/ but the .go files in there are owned by root, with read access for all, but the x-bit is not set. But setting the x-bit for the 3 files does not change the result.
The result is the same as in bug 30709 and that one has been OK'ed with this outcome, so I'll do the same here.

Whiteboard: (none) => MGA8-64-OK
CC: (none) => herman.viaene

Comment 11 Bruno Cornec 2022-11-23 21:23:36 CET
(In reply to Len Lawrence from comment #9)
> Thanks for the quick response.  This could be difficult because I know
> almost nothing about packaging and building from source.  I have the Donovan
> & Kernighan book so a simple programming project may be all we can hope for.

you could try to download the src.rpm package, install it with rpm. Something like:
$ rpm -ivh /pub/mageia/distrib/8/SRPMS/core/updates_testing/golang-1.18.8-1.mga8.src.rpm
$ cd rpmbuild
$ sudo urpmi SPECS/golang.spec
$ bm -l

to build golang if you want, and once golang is installed doing the same with 
/pub/mageia/distrib/8/SRPMS/core/release/docker-19.03.15-1.mga8.src.rpm using sudo urpmi SPECS/docker.spec
Comment 12 Len Lawrence 2022-11-24 08:07:08 CET
Thanks Bruno.  Herman has OK'd this already.
However the information here is worth noting - simpler than I thought.
Comment 13 Thomas Andrews 2022-11-24 21:47:20 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2022-11-27 18:56:12 CET

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 14 Mageia Robot 2022-11-27 21:53:28 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0444.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.