bugtraq - [SECURITY] [DSA 4380-1] golang-1.8 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 1 Feb 2019 14:39:59 +0000
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4380-1] golang-1.8 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4380-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
February 01, 2019                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : golang-1.8
CVE ID         : CVE-2018-6574 CVE-2018-7187 CVE-2019-6486

A vulnerability was discovered in the implementation of the P-521 and
P-384 elliptic curves, which could result in denial of service and in
some cases key recovery.

In addition this update fixes two vulnerabilities in "go get", which
could result in the execution of arbitrary shell commands.

For the stable distribution (stretch), these problems have been fixed in
version 1.8.1-1+deb9u1.

We recommend that you upgrade your golang-1.8 packages.

For the detailed security status of golang-1.8 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/golang-1.8

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlxUWSkACgkQEMKTtsN8
TjZLZRAAuAumJFuqfu85HiG13ZicNAvPhvVR/xd3EPJmdYwIgRtx5WZApJGO8pHK
TWYA13EvcqEg2e+iPJ1K1LFig+TueLEv5X1PB3HSyEr8Vkha1qgSxe3hSSUQrkkz
H8k5GYIBgWvNioSP+/6KH4MJhM3A7zCZHYdLwX1fTmyG4Fpo618XWVZLbJ4NnaO1
Pp8/7wBJeWBEQx0kyNk4C6VxTE22TV6W4f8wav2gtGTA4ZRS3+6Lkq9Ucqk0gQaa
rZ0qXgqApBxBs4up2XkdrTcQcYimToxCuEVDNJ4260VlevTduC5Wc5QD8Wje8a9C
7ghb8Y093Ir5B9EZf+q9X80EkTBLpk+/3x50HnsoSZ2ez/3b9URI+nSCGZviMU7V
Ha6F6dBj9MokQ+QezvqikUmo7I8nZR+i2xIULG2q9VS4HR4gLvS1hb5ctfUrLsfn
unxz/+/u1u7a+gJ5lJBYZY/q2AYwMH6Yyd1jrHFGKfdBredTPmptNQ8vE6hG/tbY
+lLcudW5hO6FWf7rOqMqdLn2LZMEOCuftyakfmnT057aw6EdmcIqHZDiD1ngauzz
r9hxnkmGiM9CToaj9XC6czvoheDLj/reemdph98BvU5oXw1zF43nCkV0I6HksxMX
5Wo/ntLA+ZwDqwDbyMrKbg7VkjWPdA1zfOc7DpMCPsD+rUa5MX8=
=UpGP
-----END PGP SIGNATURE-----