Security update for go1.23-openssl
This update for go1.23-openssl fixes the following issues:
This update ships go1.23-openssl version 1.23.2.2. (jsc#SLE-18320)
- go1.23.2 (released 2024-10-01) includes fixes to the compiler,
cgo, the runtime, and the maps, os, os/exec, time, and unique
packages.
- go#69119 os: double close pidfd if caller uses pidfd updated by os.StartProcess
- go#69156 maps: segmentation violation in maps.Clone
- go#69219 cmd/cgo: alignment issue with int128 inside of a struct
- go#69240 unique: fatal error: found pointer to free object
- go#69333 runtime,time: timer.Stop returns false even when no value is read from the channel
- go#69383 unique: large string still referenced, after interning only a small substring
- go#69402 os/exec: resource leak on exec failure
- go#69511 cmd/compile: mysterious crashes and non-determinism with range over func
- Update to version 1.23.1.1 cut from the go1.23-fips-release
branch at the revision tagged go1.23.1-1-openssl-fips.
- Update to Go 1.23.1 (#238)
- go1.23.1 (released 2024-09-05) includes security fixes to the
encoding/gob, go/build/constraint, and go/parser packages, as
well as bug fixes to the compiler, the go command, the runtime,
and the database/sql, go/types, os, runtime/trace, and unique
packages.
CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:
- go#69143 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions
- go#69145 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode
- go#69149 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse
- go#68812 os: TestChtimes failures
- go#68894 go/types: 'under' panics on Alias type
- go#68905 cmd/compile: error in Go 1.23.0 with generics, type aliases and indexing
- go#68907 os: CopyFS overwrites existing file in destination.
- go#68973 cmd/cgo: aix c-archive corrupting stack
- go#68992 unique: panic when calling unique.Make with string casted as any
- go#68994 cmd/go: any invocation creates read-only telemetry configuration file under GOMODCACHE
- go#68995 cmd/go: multi-arch build via qemu fails to exec go binary
- go#69041 database/sql: panic in database/sql.(*connRequestSet).deleteIndex
- go#69087 runtime/trace: crash during traceAdvance when collecting call stack for cgo-calling goroutine
- go#69094 cmd/go: breaking change in 1.23rc2 with version constraints in GOPATH mode
- go1.23 (released 2024-08-13) is a major release of Go.
go1.23.x minor releases will be provided through August 2025.
https://github.com/golang/go/wiki/Go-Release-Cycle
go1.23 arrives six months after go1.22. Most of its changes are
in the implementation of the toolchain, runtime, and libraries.
As always, the release maintains the Go 1 promise of
compatibility. We expect almost all Go programs to continue to
compile and run as before.
- Language change: Go 1.23 makes the (Go 1.22) 'range-over-func'
experiment a part of the language. The 'range' clause in a
'for-range' loop now accepts iterator functions of the
following types:
func(func() bool)
func(func(K) bool)
func(func(K, V) bool)
as range expressions. Calls of the iterator argument function
produce the iteration values for the 'for-range' loop. For
details see the iter package documentation and the language
spec. For motivation see the 2022 'range-over-func' discussion.
- Language change: Go 1.23 includes preview support for generic
type aliases. Building the toolchain with
GOEXPERIMENT=aliastypeparams enables this feature within a
package. (Using generic alias types across package boundaries
is not yet supported.)
- Opt-in Telemetry: Starting in Go 1.23, the Go toolchain can
collect usage and breakage statistics that help the Go team
understand how the Go toolchain is used and how well it is
working. We refer to these statistics as Go telemetry.
Go telemetry is an opt-in system, controlled by the go
telemetry command. By default, the toolchain programs collect
statistics in counter files that can be inspected locally but
are otherwise unused (go telemetry local).
To help us keep Go working well and understand Go usage, please
consider opting in to Go telemetry by running go telemetry
on. In that mode, anonymous counter reports are uploaded to
telemetry.go.dev weekly, where they are aggregated into graphs
and also made available for download by any Go contributors or
users wanting to analyze the data. See 'Go Telemetry' for more
details about the Go Telemetry system.
- go command: Setting the GOROOT_FINAL environment variable no
longer has an effect (#62047). Distributions that install the
go command to a location other than $GOROOT/bin/go should
install a symlink instead of relocating or copying the go
binary.
