BSD Portsgo -- multiple vulnerabilities
· CVE-2024-45341, CVE-2024-45336 · VuXML entry
The Go project reports: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. net/http: sensitive headers incorrectly sent after cross-domain redirect The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request …
Affected versions
- go122 < 1.22.11
- go123 < 1.23.5
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/go122 | 1.22.12_4 | fixed | |
| NetBSD | lang/go122 | 1.22.12 | not listed | |
| DragonFly | lang/go123 | 1.23.7_4 | fixed | |
| NetBSD | lang/go123 | 1.23.12 | not listed | |
| MidnightBSD | lang/go123 | 1.23.12 | out of range, by version |