[Buildroot] [PATCH v1 1/1] package/go: security bump to v1.20.7

[Buildroot] [PATCH v1 1/1] package/go: security bump to v1.20.7

[Christian Stewart via buildroot]

go1.20.7 (released 2023-08-01) includes a security fix to the crypto/tls
package, as well as bug fixes to the assembler and the compiler.

Fixes CVE-2023-29409: restrict RSA keys in certificates to <= 8192 bits

Extremely large RSA keys in certificate chains can cause a client/server to
expend significant CPU time verifying signatures. Limit this by restricting the
size of RSA keys transmitted during handshakes to <= 8192 bits.

Based on a survey of publicly trusted RSA keys, there are currently only three
certificates in circulation with keys larger than this, and all three appear to
be test certificates that are not actively deployed. It is possible there are
larger keys in use in private PKIs, but we target the web PKI, so causing
breakage here in the interests of increasing the default safety of users of
crypto/tls seems reasonable.

https://go.dev/doc/devel/release#go1.20.7

Signed-off-by: Christian Stewart <christian@aperture.us>
---
 package/go/go.hash | 2 +-
 package/go/go.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/go/go.hash b/package/go/go.hash
index 135d1ad37b..2298534d91 100644
--- a/package/go/go.hash
+++ b/package/go/go.hash
@@ -1,3 +1,3 @@
 # From https://go.dev/dl
-sha256  62ee5bc6fb55b8bae8f705e0cb8df86d6453626b4ecf93279e2867092e0b7f70  go1.20.6.src.tar.gz
+sha256  2c5ee9c9ec1e733b0dbbc2bdfed3f62306e51d8172bf38f4f4e542b27520f597  go1.20.7.src.tar.gz
 sha256  2d36597f7117c38b006835ae7f537487207d8ec407aa9d9980794b2030cbc067  LICENSE
diff --git a/package/go/go.mk b/package/go/go.mk
index efa47e5781..fc1d9ed681 100644
--- a/package/go/go.mk
+++ b/package/go/go.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GO_VERSION = 1.20.6
+GO_VERSION = 1.20.7
 GO_SITE = https://storage.googleapis.com/golang
 GO_SOURCE = go$(GO_VERSION).src.tar.gz
 
-- 
2.41.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v1 1/1] package/go: security bump to v1.20.7

[Peter Korsgaard]

>>>>> "Christian" == Christian Stewart <christian@aperture.us> writes:

 > go1.20.7 (released 2023-08-01) includes a security fix to the crypto/tls
 > package, as well as bug fixes to the assembler and the compiler.

 > Fixes CVE-2023-29409: restrict RSA keys in certificates to <= 8192 bits

 > Extremely large RSA keys in certificate chains can cause a client/server to
 > expend significant CPU time verifying signatures. Limit this by restricting the
 > size of RSA keys transmitted during handshakes to <= 8192 bits.

 > Based on a survey of publicly trusted RSA keys, there are currently only three
 > certificates in circulation with keys larger than this, and all three appear to
 > be test certificates that are not actively deployed. It is possible there are
 > larger keys in use in private PKIs, but we target the web PKI, so causing
 > breakage here in the interests of increasing the default safety of users of
 > crypto/tls seems reasonable.

 > https://go.dev/doc/devel/release#go1.20.7

 > Signed-off-by: Christian Stewart <christian@aperture.us>

For 2023.02.x and 2023.05.x I have instead bumped to 1.19.12, which
contains the same fix.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot