Linux · Security advisory · July 12, 2022

ELSA-2022-17956: Security update for 9 packages

ELSA-2022-17956, released July 12, 2022, fixes 5 CVEs across 9 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0995
95th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 5 Routine 0

Fixed package versions

ProductReleaseFixed in
delveol 80:1.8.3-1.0.1.module+el8.6.0+20704+139a7dad
go-toolsetol 80:1.18.3-1.module+el8.6.0+20704+139a7dad
golangol 80:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
golang-binol 80:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
golang-docsol 80:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
golang-miscol 80:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
golang-raceol 80:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
golang-srcol 80:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad
golang-testsol 80:1.18.3-1.0.1.module+el8.6.0+20704+139a7dad

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-24675 golang-1.18: encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. 7.5 0.0995 None reported
High CVE-2022-28327 golang-1.18-src: The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long sca... 7.5 0.0416 None reported
High CVE-2022-29526 golang-1.18: Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment 7.5 0.0295 None reported
High CVE-2022-27536 delve: go-toolset [1.18.3-1] - Update to golang 1.18.3 golang [1.18.3-1.0.1] - Rebase to 1.18.3 by adding upstream patches... 7.5 0.0147 None reported
High CVE-2022-30629 delve: Go Toolset provides the Go programming language tools and libraries 7.5 0.0121 None reported
Showing 1 to 5 of 5 1