SB2020091115 - OpenSUSE Linux update for go1.14

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper Certificate Validation (CVE-ID: CVE-2020-14039)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists when "VerifyOptions.Roots" is nil, "Certificate.Verify" does not check the EKU requirements specified in "VerifyOptions.KeyUsages".

2) Race condition (CVE-ID: CVE-2020-15586)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler. A remote attacker can exploit the race and cause a denial of service condition on the target system.

3) Infinite loop (CVE-ID: CVE-2020-16845)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in "ReadUvarint" and "ReadVarint" in "encoding/binary". A remote attacker can consume all available system resources and cause denial of service conditions.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html