====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN056
_____________________________________________________________________

DATE                : 29/01/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Systems running Go versions prior to 1.15.7,
                                      1.14.14, 1.16rc1.

=====================================================================
https://groups.google.com/g/golang-announce/c/mperVMGa98w/m/yo5W5wnvAAAJ
_____________________________________________________________________


Go 1.15.7 and Go 1.14.14 are released
Roland Shoemaker


Hello gophers,

We have just released Go 1.15.7 and Go 1.14.14 to address recently
reported security issues. We recommend that all users update to one of
these releases (if you’re not sure which, choose Go 1.15.7).

    cmd/go: packages using cgo can cause arbitrary code execution at
build time


The go command may execute arbitrary code at build time when cgo is in
use on Windows. This may occur when running “go get”, or any other
command that builds code. Only users who build untrusted code (and don’t
execute it) are affected.

In addition to Windows users, this can also affect Unix users who have
“.” listed explicitly in their PATH and are running “go get” or build
commands outside of a module or with module mode disabled.

Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

This issue is CVE-2021-3115 and Go issue golang.org/issue/43783.

For more background on the cmd/go change and help deciding whether your
own programs might have similar issues, see our blog post at
https://blog.golang.org/path-security.

    crypto/elliptic: incorrect operations on the P-224 curve


The P224() Curve implementation can in rare circumstances generate
incorrect outputs, including returning invalid points from ScalarMult.

The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls)
packages support P-224 ECDSA keys, but they are not supported by
publicly trusted certificate authorities. No other standard library or
golang.org/x/crypto package supports or uses the P-224 curve.

The incorrect output was found by the elliptic-curve-differential-fuzzer
project running on OSS-Fuzz and reported by Philippe Antoine (Catena
cyber).

This issue is CVE-2021-3114 and Go issue golang.org/issue/43786.



The upcoming Go 1.16rc1 release will also include the fixes above.

Downloads are available at https://golang.org/dl for all supported
platforms.


Thank you,

Roland on behalf of the Go team

=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================