Security update for go1.20
This update for go1.20 fixes the following issues: Update to go1.20.12: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834). - CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943). - CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833). - cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents - cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for go1.20 fixes the following issues: Update to go1.20.12: - CVE-2023-45285: cmd/go: git VCS qualifier in module path uses git:// scheme (bsc#1217834). - CVE-2023-45284: path/filepath: Clean removes ending slash for volume on Windows in Go 1.21.4 (bsc#1216943). - CVE-2023-39326: net/http: limit chunked data overhead (bsc#1217833). - cmd/compile: internal compiler error: panic during prove while compiling: unexpected induction with too many parents - cmd/go: TestScript/mod_get_direct fails with 'Filename too long' on Windows
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1206346
- https://bugzilla.suse.com/1216943
- https://bugzilla.suse.com/1217833
- https://bugzilla.suse.com/1217834
- https://www.suse.com/security/cve/CVE-2023-39326
- https://www.suse.com/security/cve/CVE-2023-45284
- https://www.suse.com/security/cve/CVE-2023-45285
- https://www.suse.com/support/update/announcement/2023/suse-su-20234708-1/