SUSE-CU-2024:5314-1: Security update of bci/golang

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/golang
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:5314-1
Container Tags        : bci/golang:1.21-openssl , bci/golang:1.21-openssl-49.6 , bci/golang:1.21.13.1-openssl , bci/golang:1.21.13.1-openssl-49.6 , bci/golang:latest , bci/golang:stable-openssl , bci/golang:stable-openssl-49.6
Container Release     : 49.6
Severity              : important
Type                  : security
References            : 1212475 1219988 1220999 1221000 1221001 1221002 1221003 1221400
                        1224017 1225973 1225974 1227314 CVE-2023-45288 CVE-2023-45289
                        CVE-2023-45290 CVE-2024-24783 CVE-2024-24784 CVE-2024-24785 CVE-2024-24787
                        CVE-2024-24789 CVE-2024-24790 CVE-2024-24791 
-----------------------------------------------------------------

The container bci/golang was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:3755-1
Released:    Thu Oct 24 09:54:02 2024
Summary:     Security update for go1.21-openssl
Type:        security
Severity:    important
References:  1212475,1219988,1220999,1221000,1221001,1221002,1221003,1221400,1224017,1225973,1225974,1227314,CVE-2023-45288,CVE-2023-45289,CVE-2023-45290,CVE-2024-24783,CVE-2024-24784,CVE-2024-24785,CVE-2024-24787,CVE-2024-24789,CVE-2024-24790,CVE-2024-24791
This update for go1.21-openssl fixes the following issues:
  
- CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
- CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
- CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)
- CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
- CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)
- CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000) 
- CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
- CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)
- CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
- CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)

Other fixes:
- Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
- Update to version 1.21.13 (bsc#1212475)
- Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
- Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)


The following package changes have been done:

- go1.21-openssl-doc-1.21.13.1-150600.16.3.1 updated
- go1.21-openssl-1.21.13.1-150600.16.3.1 updated
- go1.21-openssl-race-1.21.13.1-150600.16.3.1 updated