<div class="container">
<h1>Security update for go1.23-openssl</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2024:3937-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2024-11-07T10:08:07Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1229122">bsc#1229122</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1230252">bsc#1230252</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1230253">bsc#1230253</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1230254">bsc#1230254</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/SLE-18320">jsc#SLE-18320</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2024-34155.html">CVE-2024-34155</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2024-34156.html">CVE-2024-34156</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2024-34158.html">CVE-2024-34158</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-34155</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-34155</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-34156</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-34156</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-34158</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2024-34158</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">Development Tools Module 15-SP6</li>
<li class="list-group-item">openSUSE Leap 15.6</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 15 SP6</li>
<li class="list-group-item">SUSE Linux Enterprise Real Time 15 SP6</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP6</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP6</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves three vulnerabilities, contains one feature and has one security fix can now be installed.</p>
<h2>Description:</h2>
<p>This update for go1.23-openssl fixes the following issues:</p>
<p>This update ships go1.23-openssl version 1.23.2.2. (jsc#SLE-18320)</p>
<ul>
<li>
<p>go1.23.2 (released 2024-10-01) includes fixes to the compiler,
cgo, the runtime, and the maps, os, os/exec, time, and unique
packages.</p>
</li>
<li>
<p>go#69119 os: double close pidfd if caller uses pidfd updated by os.StartProcess</p>
</li>
<li>go#69156 maps: segmentation violation in maps.Clone</li>
<li>go#69219 cmd/cgo: alignment issue with int128 inside of a struct</li>
<li>go#69240 unique: fatal error: found pointer to free object</li>
<li>go#69333 runtime,time: timer.Stop returns false even when no value is read from the channel</li>
<li>go#69383 unique: large string still referenced, after interning only a small substring</li>
<li>go#69402 os/exec: resource leak on exec failure</li>
<li>
<p>go#69511 cmd/compile: mysterious crashes and non-determinism with range over func</p>
</li>
<li>
<p>Update to version 1.23.1.1 cut from the go1.23-fips-release
branch at the revision tagged go1.23.1-1-openssl-fips.</p>
</li>
<li>
<p>Update to Go 1.23.1 (#238)</p>
</li>
<li>
<p>go1.23.1 (released 2024-09-05) includes security fixes to the
encoding/gob, go/build/constraint, and go/parser packages, as
well as bug fixes to the compiler, the go command, the runtime,
and the database/sql, go/types, os, runtime/trace, and unique
packages.</p>
</li>
</ul>
<p>CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:</p>
<ul>
<li>go#69143 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions</li>
<li>go#69145 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode</li>
<li>go#69149 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse</li>
<li>go#68812 os: TestChtimes failures</li>
<li>go#68894 go/types: 'under' panics on Alias type</li>
<li>go#68905 cmd/compile: error in Go 1.23.0 with generics, type aliases and indexing</li>
<li>go#68907 os: CopyFS overwrites existing file in destination.</li>
<li>go#68973 cmd/cgo: aix c-archive corrupting stack</li>
<li>go#68992 unique: panic when calling unique.Make with string casted as any</li>
<li>go#68994 cmd/go: any invocation creates read-only telemetry configuration file under GOMODCACHE</li>
<li>go#68995 cmd/go: multi-arch build via qemu fails to exec go binary</li>
<li>go#69041 database/sql: panic in database/sql.(*connRequestSet).deleteIndex</li>
<li>go#69087 runtime/trace: crash during traceAdvance when collecting call stack for cgo-calling goroutine</li>
<li>
<p>go#69094 cmd/go: breaking change in 1.23rc2 with version constraints in GOPATH mode</p>
</li>
<li>
<p>go1.23 (released 2024-08-13) is a major release of Go.
go1.23.x minor releases will be provided through August 2025.
https://github.com/golang/go/wiki/Go-Release-Cycle
go1.23 arrives six months after go1.22. Most of its changes are
in the implementation of the toolchain, runtime, and libraries.
As always, the release maintains the Go 1 promise of
compatibility. We expect almost all Go programs to continue to
compile and run as before.</p>
</li>
<li>
<p>Language change: Go 1.23 makes the (Go 1.22) "range-over-func"
experiment a part of the language. The "range" clause in a
"for-range" loop now accepts iterator functions of the
following types:
func(func() bool)
func(func(K) bool)
func(func(K, V) bool)
as range expressions. Calls of the iterator argument function
produce the iteration values for the "for-range" loop. For
details see the iter package documentation and the language
spec. For motivation see the 2022 "range-over-func" discussion.</p>
</li>
<li>Language change: Go 1.23 includes preview support for generic
type aliases. Building the toolchain with
GOEXPERIMENT=aliastypeparams enables this feature within a
package. (Using generic alias types across package boundaries
is not yet supported.)</li>
<li>Opt-in Telemetry: Starting in Go 1.23, the Go toolchain can
collect usage and breakage statistics that help the Go team
understand how the Go toolchain is used and how well it is
working. We refer to these statistics as Go telemetry.
Go telemetry is an opt-in system, controlled by the go
telemetry command. By default, the toolchain programs collect
statistics in counter files that can be inspected locally but
are otherwise unused (go telemetry local).
To help us keep Go working well and understand Go usage, please
consider opting in to Go telemetry by running go telemetry
on. In that mode, anonymous counter reports are uploaded to
telemetry.go.dev weekly, where they are aggregated into graphs
and also made available for download by any Go contributors or
users wanting to analyze the data. See "Go Telemetry" for more
details about the Go Telemetry system.</li>
<li>go command: Setting the GOROOT_FINAL environment variable no
longer has an effect (#62047). Distributions that install the
go command to a location other than $GOROOT/bin/go should
install a symlink instead of relocating or copying the go
binary.</li>
<li>go command: The new go env -changed flag causes the command to
print only those settings whose effective value differs from
the default value that would be obtained in an empty
environment with no prior uses of the -w flag.</li>
<li>go command: The new go mod tidy -diff flag causes the command
not to modify the files but instead print the necessary changes
as a unified diff. It exits with a non-zero code if updates are
needed.</li>
<li>go command: The go list -m -json command now includes new Sum
and GoModSum fields. This is similar to the existing behavior
of the go mod download -json command.</li>
<li>go command: The new godebug directive in go.mod and go.work
declares a GODEBUG setting to apply for the work module or
workspace in use.</li>
<li>go vet: The go vet subcommand now includes the stdversion
analyzer, which flags references to symbols that are too new
for the version of Go in effect in the referring file. (The
effective version is determined by the go directive in the
file's enclosing go.mod file, and by any //go:build constraints
in the file.)
For example, it will report a diagnostic for a reference to the
reflect.TypeFor function (introduced in go1.22) from a file in
a module whose go.mod file specifies go 1.21.</li>
<li>cgo: cmd/cgo supports the new -ldflags flag for passing flags
to the C linker. The go command uses it automatically, avoiding
"argument list too long" errors with a very large CGO_LDFLAGS.</li>
<li>go trace: The trace tool now better tolerates partially broken
traces by attempting to recover what trace data it can. This
functionality is particularly helpful when viewing a trace that
was collected during a program crash, since the trace data
leading up to the crash will now be recoverable under most
circumstances.</li>
<li>Runtime: The traceback printed by the runtime after an
unhandled panic or other fatal error now indents the second and
subsequent lines of the error message (for example, the
argument to panic) by a single tab, so that it can be
unambiguously distinguished from the stack trace of the first
goroutine. See go#64590 for discussion.</li>
<li>Compiler: The build time overhead to building with Profile
Guided Optimization has been reduced significantly. Previously,
large builds could see 100%+ build time increase from enabling
PGO. In Go 1.23, overhead should be in the single digit
percentages.</li>
<li>Compiler: The compiler in Go 1.23 can now overlap the stack
frame slots of local variables accessed in disjoint regions of
a function, which reduces stack usage for Go applications.</li>
<li>Compiler: For 386 and amd64, the compiler will use information
from PGO to align certain hot blocks in loops. This improves
performance an additional 1-1.5% at a cost of an additional
0.1% text and binary size. This is currently only implemented
on 386 and amd64 because it has not shown an improvement on
other platforms. Hot block alignment can be disabled with
-gcflags=[<packages>=]-d=alignhot=0.</li>
<li>Linker: The linker now disallows using a //go:linkname
directive to refer to internal symbols in the standard library
(including the runtime) that are not marked with //go:linkname
on their definitions. Similarly, the linker disallows
references to such symbols from assembly code. For backward
compatibility, existing usages of //go:linkname found in a
large open-source code corpus remain supported. Any new
references to standard library internal symbols will be
disallowed.</li>
<li>Linker: A linker command line flag -checklinkname=0 can be used
to disable this check, for debugging and experimenting
purposes.</li>
<li>Linker: When building a dynamically linked ELF binary
(including PIE binary), the new -bindnow flag enables immediate
function binding.</li>
<li>Standard library changes:</li>
<li>timer: 1.23 makes two significant changes to the implementation
of time.Timer and time.Ticker.
First, Timers and Tickers that are no longer referred to by the
program become eligible for garbage collection immediately,
even if their Stop methods have not been called. Earlier
versions of Go did not collect unstopped Timers until after
they had fired and never collected unstopped Tickers.
Second, the timer channel associated with a Timer or Ticker is
now unbuffered, with capacity 0. The main effect of this change
is that Go now guarantees that for any call to a Reset or Stop
method, no stale values prepared before that call will be sent
or received after the call. Earlier versions of Go used
channels with a one-element buffer, making it difficult to use
Reset and Stop correctly. A visible effect of this change is
that len and cap of timer channels now returns 0 instead of 1,
which may affect programs that poll the length to decide
whether a receive on the timer channel will succeed. Such code
should use a non-blocking receive instead.
These new behaviors are only enabled when the main Go program
is in a module with a go.mod go line using Go 1.23.0 or
later. When Go 1.23 builds older programs, the old behaviors
remain in effect. The new GODEBUG setting asynctimerchan=1 can
be used to revert back to asynchronous channel behaviors even
when a program names Go 1.23.0 or later in its go.mod file.</li>
<li>unique: The new unique package provides facilities for
canonicalizing values (like "interning" or "hash-consing").
Any value of comparable type may be canonicalized with the new
Make[T] function, which produces a reference to a canonical
copy of the value in the form of a Handle[T]. Two Handle[T] are
equal if and only if the values used to produce the handles are
equal, allowing programs to deduplicate values and reduce their
memory footprint. Comparing two Handle[T] values is efficient,
reducing down to a simple pointer comparison.</li>
<li>iter: The new iter package provides the basic definitions for
working with user-defined iterators.</li>
<li>slices: The slices package adds several functions that work
with iterators:<ul>
<li>All returns an iterator over slice indexes and values.</li>
<li>Values returns an iterator over slice elements.</li>
<li>Backward returns an iterator that loops over a slice backward.</li>
<li>Collect collects values from an iterator into a new slice.</li>
<li>AppendSeq appends values from an iterator to an existing slice.</li>
<li>Sorted collects values from an iterator into a new slice, and then sorts the slice.</li>
<li>SortedFunc is like Sorted but with a comparison function.</li>
<li>SortedStableFunc is like SortFunc but uses a stable sort algorithm.</li>
<li>Chunk returns an iterator over consecutive sub-slices of up to n elements of a slice.</li>
</ul>
</li>
<li>maps: The maps package adds several functions that work with
iterators:<ul>
<li>All returns an iterator over key-value pairs from a map.</li>
<li>Keys returns an iterator over keys in a map.</li>
<li>Values returns an iterator over values in a map.</li>
<li>Insert adds the key-value pairs from an iterator to an existing map.</li>
<li>Collect collects key-value pairs from an iterator into a new map and returns it.</li>
</ul>
</li>
<li>structs: The new structs package provides types for struct
fields that modify properties of the containing struct type
such as memory layout.
In this release, the only such type is HostLayout which
indicates that a structure with a field of that type has a
layout that conforms to host platform expectations.</li>
<li>Minor changes to the standard library: As always, there are
various minor changes and updates to the library, made with the
Go 1 promise of compatibility in mind.</li>
<li>archive/tar: If the argument to FileInfoHeader implements the
new FileInfoNames interface, then the interface methods will be
used to set the Uname/Gname of the file header. This allows
applications to override the system-dependent Uname/Gname
lookup.</li>
<li>crypto/tls: The TLS client now supports the Encrypted Client
Hello draft specification. This feature can be enabled by
setting the Config.EncryptedClientHelloConfigList field to an
encoded ECHConfigList for the host that is being connected to.</li>
<li>crypto/tls: The QUICConn type used by QUIC implementations
includes new events reporting on the state of session
resumption, and provides a way for the QUIC layer to add data
to session tickets and session cache entries.</li>
<li>crypto/tls: 3DES cipher suites were removed from the default
list used when Config.CipherSuites is nil. The default can be
reverted by adding tls3des=1 to the GODEBUG environment
variable.</li>
<li>crypto/tls: The experimental post-quantum key exchange
mechanism X25519Kyber768Draft00 is now enabled by default when
Config.CurvePreferences is nil. The default can be reverted by
adding tlskyber=0 to the GODEBUG environment variable.</li>
<li>crypto/tls: Go 1.23 changed the behavior of X509KeyPair and
LoadX509KeyPair to populate the Certificate.Leaf field of the
returned Certificate. The new x509keypairleaf GODEBUG setting
is added for this behavior.</li>
<li>crypto/x509: CreateCertificateRequest now correctly supports
RSA-PSS signature algorithms.</li>
<li>crypto/x509: CreateCertificateRequest and CreateRevocationList
now verify the generated signature using the signer's public
key. If the signature is invalid, an error is returned. This
has been the behavior of CreateCertificate since Go 1.16.</li>
<li>crypto/x509: The x509sha1 GODEBUG setting will be removed in
the next Go major release (Go 1.24). This will mean that
crypto/x509 will no longer support verifying signatures on
certificates that use SHA-1 based signature algorithms.</li>
<li>crypto/x509: The new ParseOID function parses a dot-encoded
ASN.1 Object Identifier string. The OID type now implements the
encoding.BinaryMarshaler, encoding.BinaryUnmarshaler,
encoding.TextMarshaler, encoding.TextUnmarshaler interfaces.
database/sql</li>
<li>crypto/x509: Errors returned by driver.Valuer implementations
are now wrapped for improved error handling during operations
like DB.Query, DB.Exec, and DB.QueryRow.</li>
<li>debug/elf: The debug/elf package now defines
PT_OPENBSD_NOBTCFI. This ProgType is used to disable Branch
Tracking Control Flow Integrity (BTCFI) enforcement on OpenBSD
binaries.</li>
<li>debug/elf: Now defines the symbol type constants STT_RELC,
STT_SRELC, and STT_GNU_IFUNC.</li>
<li>encoding/binary The new Encode and Decode functions are byte
slice equivalents to Read and Write. Append allows marshaling
multiple data into the same byte slice.</li>
<li>go/ast: The new Preorder function returns a convenient iterator
over all the nodes of a syntax tree.</li>
<li>go/types: The Func type, which represents a function or method
symbol, now has a Func.Signature method that returns the
function's type, which is always a Signature.</li>
<li>go/types: The Alias type now has an Rhs method that returns the
type on the right-hand side of its declaration: given type A =
B, the Rhs of A is B. (go#66559)</li>
<li>go/types: The methods Alias.Origin, Alias.SetTypeParams,
Alias.TypeParams, and Alias.TypeArgs have been added. They are
needed for generic alias types.</li>
<li>go/types: By default, go/types now produces Alias type nodes
for type aliases. This behavior can be controlled by the
GODEBUG gotypesalias flag. Its default has changed from 0 in Go
1.22 to 1 in Go 1.23.</li>
<li>math/rand/v2: The Uint function and Rand.Uint method have been
added. They were inadvertently left out of Go 1.22.</li>
<li>math/rand/v2: The new ChaCha8.Read method implements the
io.Reader interface.</li>
<li>net: The new type KeepAliveConfig permits fine-tuning the
keep-alive options for TCP connections, via a new
TCPConn.SetKeepAliveConfig method and new KeepAliveConfig
fields for Dialer and ListenConfig.</li>
<li>net: The DNSError type now wraps errors caused by timeouts or
cancellation. For example, errors.Is(someDNSErr,
context.DeadlineExceedeed) will now report whether a DNS error
was caused by a timeout.</li>
<li>net: The new GODEBUG setting netedns0=0 disables sending EDNS0
additional headers on DNS requests, as they reportedly break
the DNS server on some modems.</li>
<li>net/http: Cookie now preserves double quotes surrounding a
cookie value. The new Cookie.Quoted field indicates whether the
Cookie.Value was originally quoted.</li>
<li>net/http: The new Request.CookiesNamed method retrieves all
cookies that match the given name.</li>
<li>net/http: The new Cookie.Partitioned field identifies cookies
with the Partitioned attribute.</li>
<li>net/http: The patterns used by ServeMux now allow one or more
spaces or tabs after the method name. Previously, only a single
space was permitted.</li>
<li>net/http: The new ParseCookie function parses a Cookie header
value and returns all the cookies which were set in it. Since
the same cookie name can appear multiple times the returned
Values can contain more than one value for a given key.</li>
<li>net/http: The new ParseSetCookie function parses a Set-Cookie
header value and returns a cookie. It returns an error on
syntax error.</li>
<li>net/http: ServeContent, ServeFile, and ServeFileFS now remove
the Cache-Control, Content-Encoding, Etag, and Last-Modified
headers when serving an error. These headers usually apply to
the non-error content, but not to the text of errors.</li>
<li>net/http: Middleware which wraps a ResponseWriter and applies
on-the-fly encoding, such as Content-Encoding: gzip, will not
function after this change. The previous behavior of
ServeContent, ServeFile, and ServeFileFS may be restored by
setting GODEBUG=httpservecontentkeepheaders=1.
Note that middleware which changes the size of the served
content (such as by compressing it) already does not function
properly when ServeContent handles a Range request. On-the-fly
compression should use the Transfer-Encoding header instead of
Content-Encoding.</li>
<li>net/http: For inbound requests, the new Request.Pattern field
contains the ServeMux pattern (if any) that matched the
request. This field is not set when GODEBUG=httpmuxgo121=1 is
set.</li>
<li>net/http/httptest: The new NewRequestWithContext method creates
an incoming request with a context.Context.</li>
<li>net/netip: In Go 1.22 and earlier, using reflect.DeepEqual to
compare an Addr holding an IPv4 address to one holding the
IPv4-mapped IPv6 form of that address incorrectly returned
true, even though the Addr values were different when comparing
with == or Addr.Compare. This bug is now fixed and all three
approaches now report the same result.</li>
<li>os: The Stat function now sets the ModeSocket bit for files
that are Unix sockets on Windows. These files are identified by
having a reparse tag set to IO_REPARSE_TAG_AF_UNIX.</li>
<li>os: On Windows, the mode bits reported by Lstat and Stat for
reparse points changed. Mount points no longer have ModeSymlink
set, and reparse points that are not symlinks, Unix sockets, or
dedup files now always have ModeIrregular set. This behavior is
controlled by the winsymlink setting. For Go 1.23, it defaults
to winsymlink=1. Previous versions default to winsymlink=0.</li>
<li>os: The CopyFS function copies an io/fs.FS into the local
filesystem.</li>
<li>os: On Windows, Readlink no longer tries to normalize volumes
to drive letters, which was not always even possible. This
behavior is controlled by the winreadlinkvolume setting. For Go
1.23, it defaults to winreadlinkvolume=1. Previous versions
default to winreadlinkvolume=0.</li>
<li>os: On Linux with pidfd support (generally Linux v5.4+),
Process-related functions and methods use pidfd (rather than
PID) internally, eliminating potential mistargeting when a PID
is reused by the OS. Pidfd support is fully transparent to a
user, except for additional process file descriptors that a
process may have.</li>
<li>path/filepath: The new Localize function safely converts a
slash-separated path into an operating system path.</li>
<li>path/filepath: On Windows, EvalSymlinks no longer evaluates
mount points, which was a source of many inconsistencies and
bugs. This behavior is controlled by the winsymlink
setting. For Go 1.23, it defaults to winsymlink=1. Previous
versions default to winsymlink=0.</li>
<li>path/filepath: On Windows, EvalSymlinks no longer tries to
normalize volumes to drive letters, which was not always even
possible. This behavior is controlled by the winreadlinkvolume
setting. For Go 1.23, it defaults to
winreadlinkvolume=1. Previous versions default to
winreadlinkvolume=0.</li>
<li>reflect: The new methods synonymous with the methods of the
same name in Value are added to Type:<ul>
<li>Type.OverflowComplex</li>
<li>Type.OverflowFloat</li>
<li>Type.OverflowInt</li>
<li>Type.OverflowUint</li>
</ul>
</li>
<li>reflect: The new SliceAt function is analogous to NewAt, but
for slices.</li>
<li>reflect: The Value.Pointer and Value.UnsafePointer methods now
support values of kind String.</li>
<li>reflect: The new methods Value.Seq and Value.Seq2 return
sequences that iterate over the value as though it were used in
a for/range loop. The new methods Type.CanSeq and Type.CanSeq2
report whether calling Value.Seq and Value.Seq2, respectively,
will succeed without panicking.</li>
<li>runtime/debug: The SetCrashOutput function allows the user to
specify an alternate file to which the runtime should write its
fatal crash report. It may be used to construct an automated
reporting mechanism for all unexpected crashes, not just those
in goroutines that explicitly use recover.</li>
<li>runtime/pprof: The maximum stack depth for alloc, mutex, block,
threadcreate and goroutine profiles has been raised from 32 to
128 frames.</li>
<li>runtime/trace: The runtime now explicitly flushes trace data
when a program crashes due to an uncaught panic. This means
that more complete trace data will be available in a trace if
the program crashes while tracing is active.</li>
<li>slices: The Repeat function returns a new slice that repeats
the provided slice the given number of times.</li>
<li>sync: The Map.Clear method deletes all the entries, resulting
in an empty Map. It is analogous to clear.</li>
<li>sync/atomic: The new And and Or operators apply a bitwise AND
or OR to the given input, returning the old value.</li>
<li>syscall: The syscall package now defines WSAENOPROTOOPT on
Windows.</li>
<li>syscall: The GetsockoptInt function is now supported on
Windows.</li>
<li>testing/fstest: TestFS now returns a structured error that can
be unwrapped (via method Unwrap() []error). This allows
inspecting errors using errors.Is or errors.As.</li>
<li>text/template: Templates now support the new "else with"
action, which reduces template complexity in some use cases.</li>
<li>time: Parse and ParseInLocation now return an error if the time
zone offset is out of range.</li>
<li>unicode/utf16: The RuneLen function returns the number of
16-bit words in the UTF-16 encoding of the rune. It returns -1
if the rune is not a valid value to encode in UTF-16.</li>
<li>Port: Darwin: As announced in the Go 1.22 release notes, Go
1.23 requires macOS 11 Big Sur or later; support for previous
versions has been discontinued.</li>
<li>Port: Linux: Go 1.23 is the last release that requires Linux
kernel version 2.6.32 or later. Go 1.24 will require Linux
kernel version 3.17 or later, with an exception that systems
running 3.10 or later will continue to be supported if the
kernel has been patched to support the getrandom system call.</li>
<li>Port: OpenBSD: Go 1.23 adds experimental support for OpenBSD on
64-bit RISC-V (GOOS=openbsd, GOARCH=riscv64).</li>
<li>Port: ARM64: Go 1.23 introduces a new GOARM64 environment
variable, which specifies the minimum target version of the
ARM64 architecture at compile time. Allowed values are v8.{0-9}
and v9.{0-5}. This may be followed by an option specifying
extensions implemented by target hardware. Valid options are
,lse and ,crypto.
The GOARM64 environment variable defaults to v8.0.</li>
<li>Port: RISC-V: Go 1.23 introduces a new GORISCV64 environment
variable, which selects the RISC-V user-mode application
profile for which to compile. Allowed values are rva20u64 and
rva22u64.
The GORISCV64 environment variable defaults to rva20u64.</li>
<li>Port: Wasm: The go_wasip1_wasm_exec script in GOROOT/misc/wasm
has dropped support for versions of wasmtime < 14.0.0.</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
openSUSE Leap 15.6
<br/>
<code>zypper in -t patch SUSE-2024-3937=1 openSUSE-SLE-15.6-2024-3937=1</code>
</li>
<li class="list-group-item">
Development Tools Module 15-SP6
<br/>
<code>zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2024-3937=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
<ul>
<li>go1.23-openssl-debuginfo-1.23.2.2-150600.13.3.1</li>
<li>go1.23-openssl-doc-1.23.2.2-150600.13.3.1</li>
<li>go1.23-openssl-1.23.2.2-150600.13.3.1</li>
</ul>
</li>
<li>
openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
<ul>
<li>go1.23-openssl-race-1.23.2.2-150600.13.3.1</li>
</ul>
</li>
<li>
Development Tools Module 15-SP6 (aarch64 ppc64le s390x x86_64)
<ul>
<li>go1.23-openssl-debuginfo-1.23.2.2-150600.13.3.1</li>
<li>go1.23-openssl-doc-1.23.2.2-150600.13.3.1</li>
<li>go1.23-openssl-1.23.2.2-150600.13.3.1</li>
<li>go1.23-openssl-race-1.23.2.2-150600.13.3.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2024-34155.html">https://www.suse.com/security/cve/CVE-2024-34155.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2024-34156.html">https://www.suse.com/security/cve/CVE-2024-34156.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2024-34158.html">https://www.suse.com/security/cve/CVE-2024-34158.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1229122">https://bugzilla.suse.com/show_bug.cgi?id=1229122</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1230252">https://bugzilla.suse.com/show_bug.cgi?id=1230252</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1230253">https://bugzilla.suse.com/show_bug.cgi?id=1230253</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1230254">https://bugzilla.suse.com/show_bug.cgi?id=1230254</a>
</li>
<li>
<a href="https://jira.suse.com/browse/SLE-18320">https://jira.suse.com/browse/SLE-18320</a>
</li>
</ul>
</div>