==========================================================================
Ubuntu Security Notice USN-7109-1
November 14, 2024

golang-1.18 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Go.

Software Description:
- golang-1.18: Go programming language compiler - metapackage

Details:

Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2
streams. An attacker could possibly use this issue to cause a denial of
service. (CVE-2022-41723)

Marten Seemann discovered that Go did not properly manage memory under
certain circumstances. An attacker could possibly use this issue to cause
a panic resulting in a denial of service. (CVE-2022-41724)

Ameya Darshan and Jakob Ackermann discovered that Go did not properly
validate the amount of memory and disk files ReadForm can consume. An
attacker could possibly use this issue to cause a panic resulting in a
denial of service. (CVE-2022-41725)

Hunter Wittenborn discovered that Go incorrectly handled the sanitization
of environment variables. An attacker could possibly use this issue to run
arbitrary commands. (CVE-2023-24531)

Jakob Ackermann discovered that Go incorrectly handled multipart
forms. An attacker could possibly use this issue to consume an excessive
amount of resources, resulting in a denial of service. (CVE-2023-24536)

Juho Nurminen discovered that Go incorrectly handled certain special
characters in directory or file paths. An attacker could possibly use
this issue to inject code into the resulting binaries. (CVE-2023-29402)

Vincent Dehors discovered that Go incorrectly handled permission bits.
An attacker could possibly use this issue to read or write files with
elevated privileges. (CVE-2023-29403)

Juho Nurminen discovered that Go incorrectly handled certain compiler
directives. An attacker could possibly use this issue to execute arbitrary
code. (CVE-2023-29404)

Juho Nurminen discovered that Go incorrectly handled certain crafted
arguments. An attacker could possibly use this issue to execute arbitrary
code at build time. (CVE-2023-29405)

Bartek Nowotarski discovered that Go incorrectly validated the contents of
host headers. A remote attacker could possibly use this issue to inject
additional headers or entire requests. (CVE-2023-29406)

Takeshi Kaneko discovered that Go did not properly handle comments and
special tags in the script context of html/template module. An attacker
could possibly use this issue to inject Javascript code and perform a
cross-site scripting attack. (CVE-2023-39318, CVE-2023-39319)

It was discovered that Go did not properly validate the "//go:cgo_"
directives during compilation. An attacker could possibly use this issue
to inject arbitrary code during compile time. (CVE-2023-39323)

It was discovered that Go did not limit the number of simultaneously
executing handler goroutines in the net/http module. An attacker could
possibly use this issue to cause a panic resulting in a denial of service.
(CVE-2023-39325)

Bartek Nowotarski was discovered that the Go net/http module did not
properly handle the requests when request's headers exceed MaxHeaderBytes.
An attacker could possibly use this issue to cause a panic resulting into
a denial of service. (CVE-2023-45288)

Bartek Nowotarski discovered that the Go net/http module did not properly
validate the total size of the parsed form when parsing a multipart form.
An attacker could possibly use this issue to cause a panic resulting into a
denial of service. (CVE-2023-45290)

John Howard discovered that the Go crypto/x509 module did not properly
handle a certificate chain which contains a certificate with an unknown
public key algorithm. An attacker could possibly use this issue to cause
a panic resulting into a denial of service. (CVE-2024-24783)

Juho Nurminen discovered that the Go net/mail module did not properly
handle comments within display names in the ParseAddressList function.
An attacker could possibly use this issue to cause a panic resulting into
a denial of service. (CVE-2024-24784)

It was discovered that the Go html/template module did not validate errors
returned from MarshalJSON methods. An attacker could possibly use this
issue to inject arbitrary code into the Go template. (CVE-2024-24785)

Yufan You discovered that the Go archive/zip module did not properly
handle certain types of invalid zip files differs from the behavior of
most zip implementations. An attacker could possibly use this issue to
cause a panic resulting into a denial of service. (CVE-2024-24789)

Enze Wang and Jianjun Chen discovered that the Go net/netip module did
not work as expected for IPv4-mapped IPv6 addresses in various Is methods.
An attacker could possibly use this issue to cause a panic resulting into
a denial of service. (CVE-2024-24790)

Geoff Franks discovered that the Go net/http module did not properly
handle responses to requests with an "Expect: 100-continue" header under
certain circumstances. An attacker could possibly use this issue to
cause a denial of service. (CVE-2024-24791)

It was discovered that the Go parser module did not properly handle deeply
nested literal values. An attacker could possibly use this issue to cause
a panic resulting in a denial of service. (CVE-2024-34155)

Md Sakib Anwar discovered that the Go encoding/gob module did not properly
handle message decoding under certain circumstances. An attacker could
possibly use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34156)

It was discovered that the Go build module did not properly handle certain
build tag lines with deeply nested expressions. An attacker could possibly
use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34158)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  golang-1.18                     1.18.1-1ubuntu1.2
  golang-1.18-go                  1.18.1-1ubuntu1.2
  golang-1.18-src                 1.18.1-1ubuntu1.2

Ubuntu 20.04 LTS
  golang-1.18                     1.18.1-1ubuntu1~20.04.3
  golang-1.18-go                  1.18.1-1ubuntu1~20.04.3
  golang-1.18-src                 1.18.1-1ubuntu1~20.04.3

Ubuntu 18.04 LTS
  golang-1.18                     1.18.1-1ubuntu1~18.04.4+esm1
                                  Available with Ubuntu Pro
  golang-1.18-go                  1.18.1-1ubuntu1~18.04.4+esm1
                                  Available with Ubuntu Pro
  golang-1.18-src                 1.18.1-1ubuntu1~18.04.4+esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  golang-1.18                     1.18.1-1ubuntu1~16.04.6+esm1
                                  Available with Ubuntu Pro
  golang-1.18-go                  1.18.1-1ubuntu1~16.04.6+esm1
                                  Available with Ubuntu Pro
  golang-1.18-src                 1.18.1-1ubuntu1~16.04.6+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7109-1
  CVE-2022-41723, CVE-2022-41724, CVE-2022-41725, CVE-2023-24531,
  CVE-2023-24536, CVE-2023-29402, CVE-2023-29403, CVE-2023-29404,
  CVE-2023-29405, CVE-2023-29406, CVE-2023-39318, CVE-2023-39319,
  CVE-2023-39323, CVE-2023-39325, CVE-2023-45288, CVE-2023-45290,
  CVE-2024-24783, CVE-2024-24784, CVE-2024-24785, CVE-2024-24789,
  CVE-2024-24790, CVE-2024-24791, CVE-2024-34155, CVE-2024-34156,
  CVE-2024-34158

Package Information:
  https://launchpad.net/ubuntu/+source/golang-1.18/1.18.1-1ubuntu1.2
  https://launchpad.net/ubuntu/+source/golang-1.18/1.18.1-1ubuntu1~20.04.3