Linux · Ubuntu · Package update · September 6, 2024

golang-1.18 1.18.1-1ubuntu1.2: golang-1.18 1.18.1-1ubuntu1.2 for Ubuntu 22.04.1 LTS (jammy)

golang-1.18 1.18.1-1ubuntu1.2, released September 6, 2024, fixes 25 CVEs in golang-1.18. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
25
4 rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.8946
99th percentile

Priority of the 25 CVEs

Patch now 0 Urgent 4 High 18 Routine 3

Fixed package versions

ProductReleaseFixed in
golang-1.18Ubuntu 22.04.1 LTS (jammy)1.18.1-1ubuntu1.2

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2023-29404 delve: [ ] [CVE-2023-29405]9.8 0.0182 None reported
Urgent CVE-2023-29405 delve: ELSA-2023-3922: go-toolset:ol8 security update (CRITICAL)9.8 0.0171 None reported
Urgent CVE-2023-29402 delve: [ ] [CVE-2023-29403] [CVE-2023-29404] [CVE-2023-29405]9.8 0.0169 None reported
Urgent CVE-2023-29403 delve: [ ] [CVE-2023-29404] [CVE-2023-29405]7.8 0.0043 None reported
High CVE-2023-45288 golang-github-prometheus-alertmanager: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516)7.5 0.8946 None reported
High CVE-2022-41723 google-guest-agent: A maliciously crafted HTTP/2 stream could cause excessive CPU consumptionin the HPACK decoder, sufficient to cause a...9.8 0.0456 None reported
High CVE-2023-39325 kubernetes1.24: go1.20: excessive resource consumption when dealing with rapid stream resets7.5 0.0380 None reported
High CVE-2024-24790 go1.21: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (bsc#1225974).7.5 0.0195 None reported
High CVE-2023-39323 ecs-service-connect-agent: Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker...8.1 0.0191 None reported
High CVE-2023-24536 aardvark-dns: CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-294009.8 0.0148 None reported
High CVE-2023-29406 etcd: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)9.8 0.0145 None reported
High CVE-2024-24791 go1.22-openssl: go#68200 go#67555 bsc#1227314 security: fix CVE net/http: expect: 100-continue handling is broken in various ways * g...7.5 0.0141 None reported
High CVE-2022-41725 aardvark-dns: CVE-2022-41724 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-294009.8 0.0124 None reported
High CVE-2023-45290 go1.21-openssl: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)7.5 0.0117 None reported
High CVE-2024-34156 go1.22: Fixed stack exhaustion in Decoder.Decode7.5 0.0113 None reported
High CVE-2022-41724 aardvark-dns: CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-294009.8 0.0111 None reported
High CVE-2024-24784 go1.21-openssl: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)7.5 0.0105 None reported
High CVE-2023-39318 aardvark-dns: ELSA-2024-0121: container-tools:4.0 security update (MODERATE)7.5 0.0093 None reported
High CVE-2023-39319 aardvark-dns: ELSA-2024-0121: container-tools:4.0 security update (MODERATE)7.5 0.0091 None reported
High CVE-2024-24785 go1.21-openssl: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)7.5 0.0080 None reported
High CVE-2024-24783 go1.21-openssl: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)7.5 0.0067 None reported
High CVE-2024-24789 go1.21: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973).7.5 0.0044 None reported
Routine CVE-2024-34158 go1.22: Fixed stack exhaustion in Parse5.9 0.0105 None reported
Routine CVE-2023-24531 golang-1.18: Command go env is documented as outputting a shell script containing the Go environmentn/a 0.0084 None reported
Routine CVE-2024-34155 go1.22: Fixed stack exhaustion in all Parse* functions5.9 0.0084 None reported
Showing 1 to 25 of 25 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.