Path to this page:
Subject: CVS commit: pkgsrc/lang
From: Benny Siegert
Date: 2025-04-01 19:44:25
Message id: 20250401174425.DBF9BFBE1@cvs.NetBSD.org
Log Message:
Update go123 to 1.23.8 and go124 to 1.24.2
These minor releases include 1 security fixes following the security policy:
- net/http: request smuggling through invalid chunked data
The net/http package accepted data in the chunked transfer encoding
containing an invalid chunk-size line terminated by a bare LF.
When used in conjunction with a server or proxy which incorrectly
interprets a bare LF in a chunk extension as part of the extension,
this could permit request smuggling.
The net/http package now rejects chunk-size lines containing a bare LF.
Thanks to Jeppe Bonde Weikop for reporting this issue.
This is CVE-2025-22871 and Go issue https://go.dev/issue/71988.
View the release notes for more information.
Files: