| <p>Hello gophers,</p> |
| <p>We have just released Go versions 1.18.1 and 1.17.9, minor point releases.</p> |
| <p>These minor releases include 3 security fixes following the <a href="https://go.dev/security">security policy</a>:</p> |
| <ul> |
| <li> |
| <p>encoding/pem: fix stack overflow in Decode</p> |
| <p>A large (more than 5 MB) PEM input can cause a stack overflow in Decode, leading the program to crash.</p> |
| <p>Thanks to Juho Nurminen of Mattermost who reported the error.</p> |
| <p>This is CVE-2022-24675 and <a href="https://go.dev/issue/51853">https://go.dev/issue/51853</a>.</p> |
| </li> |
| <li> |
| <p>crypto/elliptic: tolerate all oversized scalars in generic P-256</p> |
| <p>A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected.</p> |
| <p>This was discovered thanks to a Project Wycheproof test vector.</p> |
| <p>This is CVE-2022-28327 and <a href="https://go.dev/issue/52075">https://go.dev/issue/52075</a>.</p> |
| </li> |
| <li> |
| <p>crypto/x509: non-compliant certificates can cause a panic in Verify on macOS in Go 1.18</p> |
| <p>Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS.</p> |
| <p>These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash.</p> |
| <p>Thanks to Tailscale for doing weird things and finding this.</p> |
| <p>This is CVE-2022-27536 and <a href="https://go.dev/issue/51759">https://go.dev/issue/51759</a>.</p> |
| </li> |
| </ul> |
| <p>View the release notes for more information:<br> |
| <a href="https://go.dev/doc/devel/release#go1.18.1">https://go.dev/doc/devel/release#go1.18.1</a></p> |
| <p>You can download binary and source distributions from the Go website:<br> |
| <a href="https://go.dev/dl/">https://go.dev/dl/</a></p> |
| <p>To compile from source using a Git clone, update to the release with<br> |
| <code>git checkout go1.18.1</code> and build as usual.</p> |
| <p>Thanks to everyone who contributed to the releases.</p> |
| <p>Cheers,<br> |
| The Go team</p> |
