Sync golang-1.21 1.21.8-1 (main) from Debian unstable (main)
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| golang-1.21 (Ubuntu) |
Fix Released
|
Wishlist
|
Unassigned | ||
Bug Description
Please sync golang-1.21 1.21.8-1 (main) from Debian unstable (main)
Changelog entries since current noble version 1.21.7-2:
golang-1.21 (1.21.8-1) unstable; urgency=medium
* Team upload
* New upstream version 1.21.8
+ CVE-2024-24783: crypto/x509: Verify panics on certificates with an
unknown public key algorithm
+ CVE-2023-45290: net/http: memory exhaustion in Request.
+ CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of
sensitive headers and cookies on HTTP redirect
+ CVE-2024-24785: html/template: errors returned from MarshalJSON methods
may break template escaping
+ CVE-2024-24784: net/mail: comments in display names are incorrectly
handled
* Update upstream signing key
-- Shengjing Zhu <email address hidden> Wed, 06 Mar 2024 15:14:10 +0800
CVE References
| Changed in golang-1.21 (Ubuntu): | |
| importance: | Undecided → Wishlist |
| Graham Inggs (ginggs) wrote | #1 |
| Changed in golang-1.21 (Ubuntu): | |
| status: | New → Fix Released |
This bug was fixed in the package golang-1.21 - 1.21.8-1
Sponsored for Shengjing Zhu (zhsj)
---------------
golang-1.21 (1.21.8-1) unstable; urgency=medium
* Team upload
* New upstream version 1.21.8
+ CVE-2024-24783: crypto/x509: Verify panics on certificates with an
unknown public key algorithm
+ CVE-2023-45290: net/http: memory exhaustion in Request.
+ CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of
sensitive headers and cookies on HTTP redirect
+ CVE-2024-24785: html/template: errors returned from MarshalJSON methods
may break template escaping
+ CVE-2024-24784: net/mail: comments in display names are incorrectly
handled
* Update upstream signing key
-- Shengjing Zhu <email address hidden> Wed, 06 Mar 2024 15:14:10 +0800