# CVE-2023-45289: go1.21-openssl: This update for go1.21-openssl fixes the following issues:    - CVE-2024-24791: Fixed denial of service due to improp...

CVE-2023-45289 is fixed in 19 products on 1 platform, first by ALAS2023-2024-542, released February 29, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2023-45289
- Priority: Routine
- CVSS: 5.3 (Important)
- EPSS: 0.0108
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 29, 2024

## Description

This update for go1.21-openssl fixes the following issues:    - CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314) - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973) - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974) - CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017) - CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400) - CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000)  - CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001) - CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999) - CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002) - CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)  Other fixes: - Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320) - Update to version 1.21.13 (bsc#1212475) - Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962) - Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | delve RHEL 8 | 0:1.21.2-3.module+el8.10.0+21244+5b2d9000 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | delve almalinux 8 | 1.21.2-3.module_el8.10.0+3760+4dd778f9 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | delve ol 8 | 0:1.21.2-3.0.1.module+el8.10.0+90307+cdf2b281 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | delve rocky 8 | 0:1.21.2-3.module+el8.10.0+1814+f68f8a63 | [RLSA-2024:3259](https://patchblox.com/security/data/fix/linux/rlsa-2024-3259.md) | Jun 14, 2024 |
| Linux | docker amzn 2023 | 25.0.3-1.amzn2023.0.1 | [ALAS2023-2024-542](https://patchblox.com/security/data/fix/linux/alas2023-2024-542.md) | Feb 29, 2024 |
| Linux | docker-debuginfo amzn 2023 | 25.0.3-1.amzn2023.0.1 | [ALAS2023-2024-542](https://patchblox.com/security/data/fix/linux/alas2023-2024-542.md) | Feb 29, 2024 |
| Linux | docker-debugsource amzn 2023 | 25.0.3-1.amzn2023.0.1 | [ALAS2023-2024-542](https://patchblox.com/security/data/fix/linux/alas2023-2024-542.md) | Feb 29, 2024 |
| Linux | git-lfs RHEL 8 | 0:3.4.1-2.el8_10 | [RHSA-2024:3346](https://patchblox.com/security/data/fix/linux/rhsa-2024-3346.md) | May 23, 2024 |
| Linux | git-lfs RHEL 9 | 0:3.4.1-2.el9_4 | [RHSA-2024:2724](https://patchblox.com/security/data/fix/linux/rhsa-2024-2724.md) | May 7, 2024 |
| Linux | git-lfs almalinux 8 | 3.4.1-2.el8_10 | [ALSA-2024:3346](https://patchblox.com/security/data/fix/linux/alsa-2024-3346.md) | May 23, 2024 |
| Linux | git-lfs almalinux 9 | 3.4.1-2.el9_4 | [ALSA-2024:2724](https://patchblox.com/security/data/fix/linux/alsa-2024-2724.md) | May 7, 2024 |
| Linux | git-lfs ol 8 | 0:3.4.1-2.el8_10 | [ELSA-2024-3346](https://patchblox.com/security/data/fix/linux/elsa-2024-3346.md) | May 29, 2024 |
| Linux | git-lfs ol 9 | 0:3.4.1-2.el9_4 | [ELSA-2024-2724](https://patchblox.com/security/data/fix/linux/elsa-2024-2724.md) | May 7, 2024 |
| Linux | git-lfs rocky 8 | 0:3.4.1-2.el8_10 | [RLSA-2024:3346](https://patchblox.com/security/data/fix/linux/rlsa-2024-3346.md) | Jun 14, 2024 |
| Linux | git-lfs rocky 9 | 0:3.4.1-2.el9_4 | [RLSA-2024:2724](https://patchblox.com/security/data/fix/linux/rlsa-2024-2724.md) | May 10, 2024 |
| Linux | go-toolset RHEL 8 | 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | go-toolset RHEL 9 | 0:1.21.9-2.el9_4 | [RHSA-2024:2562](https://patchblox.com/security/data/fix/linux/rhsa-2024-2562.md) | Apr 30, 2024 |
| Linux | go-toolset almalinux 8 | 1.21.9-1.module_el8.10.0+3840+edaca3c3 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | go-toolset almalinux 9 | 1.21.9-2.el9_4 | [ALSA-2024:2562](https://patchblox.com/security/data/fix/linux/alsa-2024-2562.md) | Apr 30, 2024 |
| Linux | go-toolset ol 8 | 0:1.21.9-1.module+el8.10.0+90336+233c4160 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | go-toolset ol 9 | 0:1.21.9-2.el9_4 | [ELSA-2024-2562](https://patchblox.com/security/data/fix/linux/elsa-2024-2562.md) | May 7, 2024 |
| Linux | go-toolset rocky 8 | 0:1.21.9-1.module+el8.10.0+1814+f68f8a63 | [RLSA-2024:3259](https://patchblox.com/security/data/fix/linux/rlsa-2024-3259.md) | Jun 14, 2024 |
| Linux | go1.21-openssl opensuse-leap 15.6 | 1.21.13.1-150600.16.3.1 | [SUSE-SU-2024:3755-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3755-1.md) | Oct 24, 2024 |
| Linux | go1.21-openssl sles 15.6 | 1.21.13.1-150600.16.3.1 | [SUSE-SU-2024:3755-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3755-1.md) | Oct 24, 2024 |
| Linux | go1.22-openssl opensuse-leap 15.6 | 1.22.7.1-150600.13.3.1 | [SUSE-SU-2024:3938-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3938-1.md) | Nov 7, 2024 |
| Linux | go1.22-openssl sles 15.6 | 1.22.7.1-150600.13.3.1 | [SUSE-SU-2024:3938-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3938-1.md) | Nov 7, 2024 |
| Linux | golang RHEL 8 | 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | golang RHEL 9 | 0:1.21.9-2.el9_4 | [RHSA-2024:2562](https://patchblox.com/security/data/fix/linux/rhsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang almalinux 8 | 1.21.9-1.module_el8.10.0+3840+edaca3c3 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | golang almalinux 9 | 1.21.9-2.el9_4 | [ALSA-2024:2562](https://patchblox.com/security/data/fix/linux/alsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang amzn 2023 | 1.22.3-1.amzn2023.0.1 | [ALAS2023-2024-629](https://patchblox.com/security/data/fix/linux/alas2023-2024-629.md) | May 23, 2024 |
| Linux | golang ol 8 | 0:1.21.9-1.module+el8.10.0+90336+233c4160 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | golang ol 9 | 0:1.21.9-2.el9_4 | [ELSA-2024-2562](https://patchblox.com/security/data/fix/linux/elsa-2024-2562.md) | May 7, 2024 |
| Linux | golang rocky 8 | 0:1.21.9-1.module+el8.10.0+1814+f68f8a63 | [RLSA-2024:3259](https://patchblox.com/security/data/fix/linux/rlsa-2024-3259.md) | Jun 14, 2024 |
| Linux | golang rocky 9 | 0:1.21.9-2.el9_4 | [RLSA-2024:2562](https://patchblox.com/security/data/fix/linux/rlsa-2024-2562.md) | May 10, 2024 |
| Linux | golang-1.21 Ubuntu 20.04 LTS (focal) | 1.21.1-1~ubuntu20.04.3 | [golang-1.21 1.21.1-1~ubuntu20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-golang-1.21-1.21.1-1-ubuntu20.04.3.md) | Jun 5, 2024 |
| Linux | golang-1.21 Ubuntu 22.04.1 LTS (jammy) | 1.21.1-1~ubuntu22.04.3 | [golang-1.21 1.21.1-1~ubuntu22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.21-1.21.1-1-ubuntu22.04.3.md) | Jun 5, 2024 |
| Linux | golang-1.21-go Ubuntu 20.04 LTS (focal) | 1.21.1-1~ubuntu20.04.3 | [golang-1.21-go 1.21.1-1~ubuntu20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-golang-1.21-go-1.21.1-1-ubuntu20.04.3.md) | Jun 5, 2024 |
| Linux | golang-1.21-go Ubuntu 22.04.1 LTS (jammy) | 1.21.1-1~ubuntu22.04.3 | [golang-1.21-go 1.21.1-1~ubuntu22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.21-go-1.21.1-1-ubuntu22.04.3.md) | Jun 5, 2024 |
| Linux | golang-1.21-src Ubuntu 20.04 LTS (focal) | 1.21.1-1~ubuntu20.04.3 | [golang-1.21-src 1.21.1-1~ubuntu20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-golang-1.21-src-1.21.1-1-ubuntu20.04.3.md) | Jun 5, 2024 |
| Linux | golang-1.21-src Ubuntu 22.04.1 LTS (jammy) | 1.21.1-1~ubuntu22.04.3 | [golang-1.21-src 1.21.1-1~ubuntu22.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-golang-1.21-src-1.21.1-1-ubuntu22.04.3.md) | Jun 5, 2024 |
| Linux | golang-bin RHEL 8 | 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-bin RHEL 9 | 0:1.21.9-2.el9_4 | [RHSA-2024:2562](https://patchblox.com/security/data/fix/linux/rhsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-bin almalinux 8 | 1.21.9-1.module_el8.10.0+3840+edaca3c3 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-bin almalinux 9 | 1.21.9-2.el9_4 | [ALSA-2024:2562](https://patchblox.com/security/data/fix/linux/alsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-bin amzn 2023 | 1.22.3-1.amzn2023.0.1 | [ALAS2023-2024-629](https://patchblox.com/security/data/fix/linux/alas2023-2024-629.md) | May 23, 2024 |
| Linux | golang-bin ol 8 | 0:1.21.9-1.module+el8.10.0+90336+233c4160 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | golang-bin ol 9 | 0:1.21.9-2.el9_4 | [ELSA-2024-2562](https://patchblox.com/security/data/fix/linux/elsa-2024-2562.md) | May 7, 2024 |
| Linux | golang-docs RHEL 8 | 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-docs RHEL 9 | 0:1.21.9-2.el9_4 | [RHSA-2024:2562](https://patchblox.com/security/data/fix/linux/rhsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-docs almalinux 8 | 1.21.9-1.module_el8.10.0+3840+edaca3c3 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-docs almalinux 9 | 1.21.9-2.el9_4 | [ALSA-2024:2562](https://patchblox.com/security/data/fix/linux/alsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-docs amzn 2023 | 1.22.3-1.amzn2023.0.1 | [ALAS2023-2024-629](https://patchblox.com/security/data/fix/linux/alas2023-2024-629.md) | May 23, 2024 |
| Linux | golang-docs ol 8 | 0:1.21.9-1.module+el8.10.0+90336+233c4160 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | golang-docs ol 9 | 0:1.21.9-2.el9_4 | [ELSA-2024-2562](https://patchblox.com/security/data/fix/linux/elsa-2024-2562.md) | May 7, 2024 |
| Linux | golang-github-prometheus-prometheus sles 15.7 | 3.13.2-150100.4.40.2 | [SUSE-SU-2026:4606-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4606-1.md) | Nov 7, 2026 |
| Linux | golang-misc RHEL 8 | 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-misc RHEL 9 | 0:1.21.9-2.el9_4 | [RHSA-2024:2562](https://patchblox.com/security/data/fix/linux/rhsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-misc almalinux 8 | 1.21.9-1.module_el8.10.0+3840+edaca3c3 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-misc almalinux 9 | 1.21.9-2.el9_4 | [ALSA-2024:2562](https://patchblox.com/security/data/fix/linux/alsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-misc amzn 2023 | 1.22.3-1.amzn2023.0.1 | [ALAS2023-2024-629](https://patchblox.com/security/data/fix/linux/alas2023-2024-629.md) | May 23, 2024 |
| Linux | golang-misc ol 8 | 0:1.21.9-1.module+el8.10.0+90336+233c4160 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | golang-misc ol 9 | 0:1.21.9-2.el9_4 | [ELSA-2024-2562](https://patchblox.com/security/data/fix/linux/elsa-2024-2562.md) | May 7, 2024 |
| Linux | golang-shared amzn 2023 | 1.22.3-1.amzn2023.0.1 | [ALAS2023-2024-629](https://patchblox.com/security/data/fix/linux/alas2023-2024-629.md) | May 23, 2024 |
| Linux | golang-src RHEL 8 | 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-src RHEL 9 | 0:1.21.9-2.el9_4 | [RHSA-2024:2562](https://patchblox.com/security/data/fix/linux/rhsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-src almalinux 8 | 1.21.9-1.module_el8.10.0+3840+edaca3c3 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-src almalinux 9 | 1.21.9-2.el9_4 | [ALSA-2024:2562](https://patchblox.com/security/data/fix/linux/alsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-src amzn 2023 | 1.22.3-1.amzn2023.0.1 | [ALAS2023-2024-629](https://patchblox.com/security/data/fix/linux/alas2023-2024-629.md) | May 23, 2024 |
| Linux | golang-src ol 8 | 0:1.21.9-1.module+el8.10.0+90336+233c4160 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | golang-src ol 9 | 0:1.21.9-2.el9_4 | [ELSA-2024-2562](https://patchblox.com/security/data/fix/linux/elsa-2024-2562.md) | May 7, 2024 |
| Linux | golang-tests RHEL 8 | 0:1.21.9-1.module+el8.10.0+21671+b35c3b78 | [RHSA-2024:3259](https://patchblox.com/security/data/fix/linux/rhsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-tests RHEL 9 | 0:1.21.9-2.el9_4 | [RHSA-2024:2562](https://patchblox.com/security/data/fix/linux/rhsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-tests almalinux 8 | 1.21.9-1.module_el8.10.0+3840+edaca3c3 | [ALSA-2024:3259](https://patchblox.com/security/data/fix/linux/alsa-2024-3259.md) | May 22, 2024 |
| Linux | golang-tests almalinux 9 | 1.21.9-2.el9_4 | [ALSA-2024:2562](https://patchblox.com/security/data/fix/linux/alsa-2024-2562.md) | Apr 30, 2024 |
| Linux | golang-tests amzn 2023 | 1.22.3-1.amzn2023.0.1 | [ALAS2023-2024-629](https://patchblox.com/security/data/fix/linux/alas2023-2024-629.md) | May 23, 2024 |
| Linux | golang-tests ol 8 | 0:1.21.9-1.module+el8.10.0+90336+233c4160 | [ELSA-2024-3259](https://patchblox.com/security/data/fix/linux/elsa-2024-3259.md) | May 29, 2024 |
| Linux | golang-tests ol 9 | 0:1.21.9-2.el9_4 | [ELSA-2024-2562](https://patchblox.com/security/data/fix/linux/elsa-2024-2562.md) | May 7, 2024 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.