Path to this page:
Subject: CVS commit: pkgsrc/lang
From: Benny Siegert
Date: 2021-07-13 12:05:08
Message id: 20210713100508.9DBBAFA95@cvs.NetBSD.org
Log Message:
Update go115 to 1.15.14.
This minor release includes a security fix according to the new security policy.
crypto/tls clients can panic when provided a certificate of the wrong type for
the negotiated parameters. net/http clients performing HTTPS requests are also
affected. The panic can be triggered by an attacker in a privileged network
position without access to the server certificate's private key, as long as a
trusted ECDSA or Ed25519 certificate for the server exists (or can be issued),
or the client is configured with Config.InsecureSkipVerify. Clients that
disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher
suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.
This is issue 47143 and CVE-2021-34558. Thanks to Imre Rad for reporting this
issue.
Files: