| Message ID | 20230801204830.175727-1-christian@aperture.us |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [v1,1/1] package/go: security bump to v1.20.7 | expand |
>>>>> "Christian" == Christian Stewart <christian@aperture.us> writes: > go1.20.7 (released 2023-08-01) includes a security fix to the crypto/tls > package, as well as bug fixes to the assembler and the compiler. > Fixes CVE-2023-29409: restrict RSA keys in certificates to <= 8192 bits > Extremely large RSA keys in certificate chains can cause a client/server to > expend significant CPU time verifying signatures. Limit this by restricting the > size of RSA keys transmitted during handshakes to <= 8192 bits. > Based on a survey of publicly trusted RSA keys, there are currently only three > certificates in circulation with keys larger than this, and all three appear to > be test certificates that are not actively deployed. It is possible there are > larger keys in use in private PKIs, but we target the web PKI, so causing > breakage here in the interests of increasing the default safety of users of > crypto/tls seems reasonable. > https://go.dev/doc/devel/release#go1.20.7 > Signed-off-by: Christian Stewart <christian@aperture.us> For 2023.02.x and 2023.05.x I have instead bumped to 1.19.12, which contains the same fix.
diff --git a/package/go/go.hash b/package/go/go.hash index 135d1ad37b..2298534d91 100644 --- a/package/go/go.hash +++ b/package/go/go.hash @@ -1,3 +1,3 @@ # From https://go.dev/dl -sha256 62ee5bc6fb55b8bae8f705e0cb8df86d6453626b4ecf93279e2867092e0b7f70 go1.20.6.src.tar.gz +sha256 2c5ee9c9ec1e733b0dbbc2bdfed3f62306e51d8172bf38f4f4e542b27520f597 go1.20.7.src.tar.gz sha256 2d36597f7117c38b006835ae7f537487207d8ec407aa9d9980794b2030cbc067 LICENSE diff --git a/package/go/go.mk b/package/go/go.mk index efa47e5781..fc1d9ed681 100644 --- a/package/go/go.mk +++ b/package/go/go.mk @@ -4,7 +4,7 @@ # ################################################################################ -GO_VERSION = 1.20.6 +GO_VERSION = 1.20.7 GO_SITE = https://storage.googleapis.com/golang GO_SOURCE = go$(GO_VERSION).src.tar.gz
go1.20.7 (released 2023-08-01) includes a security fix to the crypto/tls package, as well as bug fixes to the assembler and the compiler. Fixes CVE-2023-29409: restrict RSA keys in certificates to <= 8192 bits Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. Limit this by restricting the size of RSA keys transmitted during handshakes to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. https://go.dev/doc/devel/release#go1.20.7 Signed-off-by: Christian Stewart <christian@aperture.us> --- package/go/go.hash | 2 +- package/go/go.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)