CVE-2023-45289

go1.21-openssl: This update for go1.21-openssl fixes the following issues: - CVE-2024-24791: Fixed denial of service due to improp...

CVE-2023-45289 is fixed in 19 products on 1 platform, first by ALAS2023-2024-542, released February 29, 2024. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
5.3
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0108
65th percentile

This update for go1.21-openssl fixes the following issues: - CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314) - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973) - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974) - CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017) - CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400) - CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000) - CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001) - CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999) - CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002) - CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003) Other fixes: - Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320) - Update to version 1.21.13 (bsc#1212475) - Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962) - Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

Where it's fixed

ProductFixed inFixReleased
Linux
delve · RHEL 8 0:1.21.2-3.module+el8.10.0+21244+5b2d9000 RHSA-2024:3259 May 22, 2024
delve · almalinux 8 1.21.2-3.module_el8.10.0+3760+4dd778f9 ALSA-2024:3259 May 22, 2024
delve · ol 8 0:1.21.2-3.0.1.module+el8.10.0+90307+cdf2b281 ELSA-2024-3259 May 29, 2024
delve · rocky 8 0:1.21.2-3.module+el8.10.0+1814+f68f8a63 RLSA-2024:3259 Jun 14, 2024
docker · amzn 2023 25.0.3-1.amzn2023.0.1 ALAS2023-2024-542 Feb 29, 2024
docker-debuginfo · amzn 2023 25.0.3-1.amzn2023.0.1 ALAS2023-2024-542 Feb 29, 2024
docker-debugsource · amzn 2023 25.0.3-1.amzn2023.0.1 ALAS2023-2024-542 Feb 29, 2024
git-lfs · RHEL 8 0:3.4.1-2.el8_10 RHSA-2024:3346 May 23, 2024
git-lfs · RHEL 9 0:3.4.1-2.el9_4 RHSA-2024:2724 May 7, 2024
git-lfs · almalinux 8 3.4.1-2.el8_10 ALSA-2024:3346 May 23, 2024
git-lfs · almalinux 9 3.4.1-2.el9_4 ALSA-2024:2724 May 7, 2024
git-lfs · ol 8 0:3.4.1-2.el8_10 ELSA-2024-3346 May 29, 2024
git-lfs · ol 9 0:3.4.1-2.el9_4 ELSA-2024-2724 May 7, 2024
git-lfs · rocky 8 0:3.4.1-2.el8_10 RLSA-2024:3346 Jun 14, 2024
git-lfs · rocky 9 0:3.4.1-2.el9_4 RLSA-2024:2724 May 10, 2024
go-toolset · RHEL 8 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 RHSA-2024:3259 May 22, 2024
go-toolset · RHEL 9 0:1.21.9-2.el9_4 RHSA-2024:2562 Apr 30, 2024
go-toolset · almalinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3 ALSA-2024:3259 May 22, 2024
go-toolset · almalinux 9 1.21.9-2.el9_4 ALSA-2024:2562 Apr 30, 2024
go-toolset · ol 8 0:1.21.9-1.module+el8.10.0+90336+233c4160 ELSA-2024-3259 May 29, 2024
go-toolset · ol 9 0:1.21.9-2.el9_4 ELSA-2024-2562 May 7, 2024
go-toolset · rocky 8 0:1.21.9-1.module+el8.10.0+1814+f68f8a63 RLSA-2024:3259 Jun 14, 2024
go1.21-openssl · opensuse-leap 15.6 1.21.13.1-150600.16.3.1 SUSE-SU-2024:3755-1 Oct 24, 2024
go1.21-openssl · sles 15.6 1.21.13.1-150600.16.3.1 SUSE-SU-2024:3755-1 Oct 24, 2024
go1.22-openssl · opensuse-leap 15.6 1.22.7.1-150600.13.3.1 SUSE-SU-2024:3938-1 Nov 7, 2024
go1.22-openssl · sles 15.6 1.22.7.1-150600.13.3.1 SUSE-SU-2024:3938-1 Nov 7, 2024
golang · RHEL 8 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 RHSA-2024:3259 May 22, 2024
golang · RHEL 9 0:1.21.9-2.el9_4 RHSA-2024:2562 Apr 30, 2024
golang · almalinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3 ALSA-2024:3259 May 22, 2024
golang · almalinux 9 1.21.9-2.el9_4 ALSA-2024:2562 Apr 30, 2024
golang · amzn 2023 1.22.3-1.amzn2023.0.1 ALAS2023-2024-629 May 23, 2024
golang · ol 8 0:1.21.9-1.module+el8.10.0+90336+233c4160 ELSA-2024-3259 May 29, 2024
golang · ol 9 0:1.21.9-2.el9_4 ELSA-2024-2562 May 7, 2024
golang · rocky 8 0:1.21.9-1.module+el8.10.0+1814+f68f8a63 RLSA-2024:3259 Jun 14, 2024
golang · rocky 9 0:1.21.9-2.el9_4 RLSA-2024:2562 May 10, 2024
golang-1.21 · Ubuntu 20.04 LTS (focal) 1.21.1-1~ubuntu20.04.3 golang-1.21 1.21.1-1~ubuntu20.04.3 Jun 5, 2024
golang-1.21 · Ubuntu 22.04.1 LTS (jammy) 1.21.1-1~ubuntu22.04.3 golang-1.21 1.21.1-1~ubuntu22.04.3 Jun 5, 2024
golang-1.21-go · Ubuntu 20.04 LTS (focal) 1.21.1-1~ubuntu20.04.3 golang-1.21-go 1.21.1-1~ubuntu20.04.3 Jun 5, 2024
golang-1.21-go · Ubuntu 22.04.1 LTS (jammy) 1.21.1-1~ubuntu22.04.3 golang-1.21-go 1.21.1-1~ubuntu22.04.3 Jun 5, 2024
golang-1.21-src · Ubuntu 20.04 LTS (focal) 1.21.1-1~ubuntu20.04.3 golang-1.21-src 1.21.1-1~ubuntu20.04.3 Jun 5, 2024
golang-1.21-src · Ubuntu 22.04.1 LTS (jammy) 1.21.1-1~ubuntu22.04.3 golang-1.21-src 1.21.1-1~ubuntu22.04.3 Jun 5, 2024
golang-bin · RHEL 8 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 RHSA-2024:3259 May 22, 2024
golang-bin · RHEL 9 0:1.21.9-2.el9_4 RHSA-2024:2562 Apr 30, 2024
golang-bin · almalinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3 ALSA-2024:3259 May 22, 2024
golang-bin · almalinux 9 1.21.9-2.el9_4 ALSA-2024:2562 Apr 30, 2024
golang-bin · amzn 2023 1.22.3-1.amzn2023.0.1 ALAS2023-2024-629 May 23, 2024
golang-bin · ol 8 0:1.21.9-1.module+el8.10.0+90336+233c4160 ELSA-2024-3259 May 29, 2024
golang-bin · ol 9 0:1.21.9-2.el9_4 ELSA-2024-2562 May 7, 2024
golang-docs · RHEL 8 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 RHSA-2024:3259 May 22, 2024
golang-docs · RHEL 9 0:1.21.9-2.el9_4 RHSA-2024:2562 Apr 30, 2024
golang-docs · almalinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3 ALSA-2024:3259 May 22, 2024
golang-docs · almalinux 9 1.21.9-2.el9_4 ALSA-2024:2562 Apr 30, 2024
golang-docs · amzn 2023 1.22.3-1.amzn2023.0.1 ALAS2023-2024-629 May 23, 2024
golang-docs · ol 8 0:1.21.9-1.module+el8.10.0+90336+233c4160 ELSA-2024-3259 May 29, 2024
golang-docs · ol 9 0:1.21.9-2.el9_4 ELSA-2024-2562 May 7, 2024
golang-github-prometheus-prometheus · sles 15.7 3.13.2-150100.4.40.2 SUSE-SU-2026:4606-1 Nov 7, 2026
golang-misc · RHEL 8 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 RHSA-2024:3259 May 22, 2024
golang-misc · RHEL 9 0:1.21.9-2.el9_4 RHSA-2024:2562 Apr 30, 2024
golang-misc · almalinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3 ALSA-2024:3259 May 22, 2024
golang-misc · almalinux 9 1.21.9-2.el9_4 ALSA-2024:2562 Apr 30, 2024
golang-misc · amzn 2023 1.22.3-1.amzn2023.0.1 ALAS2023-2024-629 May 23, 2024
golang-misc · ol 8 0:1.21.9-1.module+el8.10.0+90336+233c4160 ELSA-2024-3259 May 29, 2024
golang-misc · ol 9 0:1.21.9-2.el9_4 ELSA-2024-2562 May 7, 2024
golang-shared · amzn 2023 1.22.3-1.amzn2023.0.1 ALAS2023-2024-629 May 23, 2024
golang-src · RHEL 8 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 RHSA-2024:3259 May 22, 2024
golang-src · RHEL 9 0:1.21.9-2.el9_4 RHSA-2024:2562 Apr 30, 2024
golang-src · almalinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3 ALSA-2024:3259 May 22, 2024
golang-src · almalinux 9 1.21.9-2.el9_4 ALSA-2024:2562 Apr 30, 2024
golang-src · amzn 2023 1.22.3-1.amzn2023.0.1 ALAS2023-2024-629 May 23, 2024
golang-src · ol 8 0:1.21.9-1.module+el8.10.0+90336+233c4160 ELSA-2024-3259 May 29, 2024
golang-src · ol 9 0:1.21.9-2.el9_4 ELSA-2024-2562 May 7, 2024
golang-tests · RHEL 8 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 RHSA-2024:3259 May 22, 2024
golang-tests · RHEL 9 0:1.21.9-2.el9_4 RHSA-2024:2562 Apr 30, 2024
golang-tests · almalinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3 ALSA-2024:3259 May 22, 2024
golang-tests · almalinux 9 1.21.9-2.el9_4 ALSA-2024:2562 Apr 30, 2024
golang-tests · amzn 2023 1.22.3-1.amzn2023.0.1 ALAS2023-2024-629 May 23, 2024
golang-tests · ol 8 0:1.21.9-1.module+el8.10.0+90336+233c4160 ELSA-2024-3259 May 29, 2024
golang-tests · ol 9 0:1.21.9-2.el9_4 ELSA-2024-2562 May 7, 2024

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.