Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
93c0e3e1 by Salvatore Bonaccorso at 2026-07-13T08:38:39+02:00
Update golang notes for lower bounds
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2920,7 +2920,7 @@ CVE-2026-39822 (On Unix systems, opening a file in an
os.Root improperly follows
- golang-1.19 <removed>
[bookworm] - golang-1.19 <not-affected> (os.Root API introduced in Go
1.24; absent in 1.19)
- golang-1.15 <not-affected> (Vulnerable code introduced later)
- NOTE: golang-1.15: os.Root API introduced in Go 1.24
(go.dev/doc/go1.24); absent in 1.15
+ NOTE: os.Root API introduced in Go 1.24 (go.dev/doc/go1.24)
NOTE: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
NOTE: https://github.com/golang/go/issues/79005
NOTE: Fixed by:
https://github.com/golang/go/commit/f9ef7f55988f03afeb3b8354367d0fa8d053683d
(go1.26.5)
@@ -2934,7 +2934,7 @@ CVE-2026-42505 (Handshakes which used Encrypted Client
Hello could be de-anonymi
- golang-1.19 <removed>
[bookworm] - golang-1.19 <not-affected> (crypto/tls client ECH
introduced in Go 1.23; absent in 1.19)
- golang-1.15 <not-affected> (Vulnerable code introduced later)
- NOTE: golang-1.15: crypto/tls client Encrypted Client Hello introduced
in Go 1.23 (issue #63369); absent in 1.15
+ NOTE: crypto/tls client Encrypted Client Hello introduced in Go 1.23
(issue #63369)
NOTE: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
NOTE: https://github.com/golang/go/issues/79282
NOTE: Fixed by:
https://github.com/golang/go/commit/ca8ca590ccfda1e1c3186faf975afdb02cb6d2f0
(go1.26.5)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/93c0e3e141e9c6dec4f6175b034899b1af40b67f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/93c0e3e141e9c6dec4f6175b034899b1af40b67f
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
