Subject: CVS commit: pkgsrc/lang
From: Benny Siegert
Date: 2021-07-13 12:05:08
Message id: 20210713100508.9DBBAFA95@cvs.NetBSD.org

Log Message:
Update go115 to 1.15.14.

This minor release includes a security fix according to the new security policy.

crypto/tls clients can panic when provided a certificate of the wrong type for
the negotiated parameters. net/http clients performing HTTPS requests are also
affected. The panic can be triggered by an attacker in a privileged network
position without access to the server certificate's private key, as long as a
trusted ECDSA or Ed25519 certificate for the server exists (or can be issued),
or the client is configured with Config.InsecureSkipVerify. Clients that
disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher
suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.

This is issue 47143 and CVE-2021-34558. Thanks to Imre Rad for reporting this
issue.

Files:
RevisionActionfile
1.121modifypkgsrc/lang/go/version.mk
1.8modifypkgsrc/lang/go115/Makefile
1.9modifypkgsrc/lang/go115/PLIST
1.11modifypkgsrc/lang/go115/distinfo