./lang/go114, The Go programming language

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 1.14.12, Package name: go114-1.14.12, Maintainer: bsiegert

The Go programming language is an open source project to make
programmers more productive.

Go is expressive, concise, clean, and efficient. Its concurrency
mechanisms make it easy to write programs that get the most out of
multicore and networked machines, while its novel type system enables
flexible and modular program construction. Go compiles quickly to
machine code yet has the convenience of garbage collection and the power
of run-time reflection. It's a fast, statically typed, compiled language
that feels like a dynamically typed, interpreted language.


Required to run:
[lang/perl5] [shells/bash]

Required to build:
[pkgtools/cwrappers] [lang/go14]

Master sites:

SHA1: b23a42c9085b5bcef74c23f4ffed41f16ee3a33c
RMD160: 161c44071a0cc8fa992dfcf7d1e42f74d241b3c0
Filesize: 22025.229 KB

Version history: (Expand)


CVS history: (Expand)


   2020-11-13 19:27:35 by Benny Siegert | Files touched by this commit (3) | Package updated
Log message:
Update go114 to 1.14.12 (security fix).

   - math/big: panic during recursive division of very large numbers

A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod,
ModInverse, ModSqrt, Jacobi, and GCD) can panic when provided crafted large
inputs. For the panic to happen, the divisor or modulo argument must be larger
than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit
architectures). Multiple math/big.Rat <https://pkg.go.dev/math/big#Rat> methods
are similarly affected.

crypto/rsa.VerifyPSS <https://pkg.go.dev/crypto/rsa#VerifyPSS>,
crypto/rsa.VerifyPKCS1v15 <https://pkg.go.dev/crypto/rsa#VerifyPKCS1v15>,
and crypto/dsa.Verify <https://pkg.go.dev/crypto/dsa#Verify> may panic when
provided crafted public keys and signatures. crypto/ecdsa and
crypto/elliptic operations may only be affected if custom CurveParams
<https://pkg.go.dev/crypto/elliptic#CurveParams> with unusually large field
sizes (several times larger than the largest supported curve, P-521) are in
use. Using crypto/x509.Verify on a crafted X.509 certificate chain can lead
to a panic, even if the certificates don’t chain to a trusted root. The
chain can be delivered via a crypto/tls connection to a client, or to a
server that accepts and verifies client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept
client certificates will recover the panic and are unaffected.

Moreover, an application might crash invoking
crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate
request or during a golang.org/x/crypto/otr conversation. Parsing a
golang.org/x/crypto/openpgp Entity or verifying a signature may crash.
Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host
key, while a server could panic if either PublicKeyCallback accepts a
malformed public key, or if IsUserAuthority accepts a certificate with a
malformed public key.

Thanks to the Go Ethereum team and the OSS-Fuzz project for reporting this.
Thanks to Rémy Oudompheng and Robert Griesemer for their help developing
and validating the fix.

This issue is CVE-2020-28362 and Go issue golang.org/issue/42552.

   - cmd/go: arbitrary code execution at build time through cgo

The go command may execute arbitrary code at build time when cgo is in use.
This may occur when running go get on a malicious package, or any other
command that builds untrusted code.

This can be caused by malicious gcc flags specified via a #cgo directive,
or by a malicious symbol name in a linked object file.

These issues are CVE-2020-28367 and CVE-2020-28366, and Go issues
golang.org/issue/42556 and golang.org/issue/42559 respectively.
   2020-11-08 21:12:31 by Benny Siegert | Files touched by this commit (2) | Package updated
Log message:
Update go114 to 1.14.11

go1.14.11 (released 2020/11/05) includes fixes to the runtime, and the net/http
and time packages. See the Go 1.14.11 milestone on our issue tracker for
details.
   2020-10-15 14:01:14 by Benny Siegert | Files touched by this commit (3) | Package updated
Log message:
Update go114 to 1.14.10.

go1.14.9 (released 2020/09/09) includes fixes to the compiler, linker, runtime,
documentation, and the net/http and testing packages. See the Go 1.14.9
milestone on our issue tracker for details.

go1.14.10 (released 2020/10/14) includes fixes to the compiler, runtime, and
the plugin and testing packages. See the Go 1.14.10 milestone on our issue
tracker for details.
   2020-09-03 09:03:27 by Benny Siegert | Files touched by this commit (3) | Package updated
Log message:
Update go114 to 1.14.8.

go1.14.8 (released 2020/09/01) includes security fixes to the net/http/cgi and
net/http/fcgi packages. See the Go 1.14.8 milestone on our issue tracker for
details.
   2020-08-31 20:13:29 by Thomas Klausner | Files touched by this commit (3631) | Package updated
Log message:
*: bump PKGREVISION for perl-5.32.
   2020-08-14 20:45:56 by Benny Siegert | Files touched by this commit (2) | Package updated
Log message:
Update go114 to 1.14.7.

go1.14.7 (released 2020/08/06) includes security fixes to the encoding/binary
package. See the Go 1.14.7 milestone on our issue tracker for details.
   2020-07-17 19:20:06 by Benny Siegert | Files touched by this commit (3) | Package updated
Log message:
Update go114 to 1.14.6.

go1.14.5 (released 2020/07/14) includes security fixes to the crypto/x509 and
net/http packages. See the Go 1.14.5 milestone on our issue tracker for
details.

go1.14.6 (released 2020/07/16) includes fixes to the go command, the compiler,
the linker, vet, and the database/sql, encoding/json, net/http, reflect, and
testing packages. See the Go 1.14.6 milestone on our issue tracker for details.
   2020-06-17 11:37:25 by Benny Siegert | Files touched by this commit (3) | Package updated
Log message:
Update go114 to 1.14.4.

go1.14.3 (released 2020/05/14) includes fixes to cgo, the compiler, the
runtime, and the go/doc and math/big packages. See the Go 1.14.3
milestone on our issue tracker for details.

go1.14.4 (released 2020/06/01) includes fixes to the go doc command, the
runtime, and the encoding/json and os packages. See the Go 1.14.4
milestone on our issue tracker for details.