golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Debian Bug report logs - #795106
golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Mon, 10 Aug 2015 18:45:23 +0200

Source: golang
Version: 2:1.0.2-1
Severity: important
Tags: security upstream fixed-upstream

Hi,

See https://marc.info/?l=oss-security&m=143885136906807&w=2  for the
CVE assignments for the issues.

Regards,
Salvatore

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <admwiggin@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 795106@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Mon, 10 Aug 2015 16:04:28 -0700

On 10 August 2015 at 09:45, Salvatore Bonaccorso <carnil@debian.org> wrote:
> See https://marc.info/?l=oss-security&m=143885136906807&w=2  for the
> CVE assignments for the issues.

Looks like we need to work on backporting three commits to 1.0.2,
1.3.3, and 1.4.2:

- https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
- https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f
- https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e

I foolishly started my attempts with 1.0.2 so I'm not making a lot of
progress.  I'd imagine the patches will be simpler to apply to 1.4.2
first (since it's much more recent and should have a more familiar
codebase to what the patches are expecting).

♥,
- Tianon
  4096R / B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4

Message #20 received at submit@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <admwiggin@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 795106@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Tue, 11 Aug 2015 21:40:45 -0700

[Message part 1 (text/plain, inline)]

On 10 August 2015 at 16:04, Tianon Gravi <admwiggin@gmail.com> wrote:
> Looks like we need to work on backporting three commits to 1.0.2,
> 1.3.3, and 1.4.2:
>
> - https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
> - https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f
> - https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e

The attached patch is all three of these fix commits, and works as-is on 1.4.2.

Will start working on a patch we can include in 1.3.3 next.

♥,
- Tianon
  4096R / B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4

[cve-2015-5739-5740-5741.patch (text/x-patch, attachment)]

Message #30 received at 795106@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <admwiggin@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 795106@bugs.debian.org

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Tue, 11 Aug 2015 21:53:47 -0700

[Message part 1 (text/plain, inline)]

On 11 August 2015 at 21:40, Tianon Gravi <admwiggin@gmail.com> wrote:
>> Looks like we need to work on backporting three commits to 1.0.2,
>> 1.3.3, and 1.4.2:
>>
>> - https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
>> - https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f
>> - https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e
>
> Will start working on a patch we can include in 1.3.3 next.

Attached is a patch that can be included to fix 1.3.3.  It _should_
differ from the patch supplied for 1.4.2 only in context -- I used Git
to cherry-pick the actual commits above (same as I did for 1.4.2), so
it's a 100% faithful representation of those commits applied against
1.3.3.

♥,
- Tianon
  4096R / B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4

[cve-2015-5739-5740-5741.patch (text/x-patch, attachment)]

Message #35 received at 795106@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <admwiggin@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 795106@bugs.debian.org

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Tue, 11 Aug 2015 22:22:35 -0700

[Message part 1 (text/plain, inline)]

On 10 August 2015 at 16:04, Tianon Gravi <admwiggin@gmail.com> wrote:
> Looks like we need to work on backporting three commits to 1.0.2,
> 1.3.3, and 1.4.2:
>
> - https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
> - https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f
> - https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e

Finally, the attached patch should work against 1.0.2.  Going the Git
route to cherry-pick turned out to be much simpler for me than trying
to massage the patch directly.  I haven't been able to verify proper
compilation with this one yet, however.  That's my next goal.

♥,
- Tianon
  4096R / B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4

[cve-2015-5739-5740-5741.patch (text/x-patch, attachment)]

Message #40 received at 795106@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <admwiggin@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 795106@bugs.debian.org

Cc: Paul Tagliamonte <paultag@debian.org>

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Tue, 11 Aug 2015 22:35:02 -0700

On 11 August 2015 at 22:22, Tianon Gravi <admwiggin@gmail.com> wrote:
> I haven't been able to verify proper compilation with this one yet, however.  That's my next goal.

Ok, all patches have been tested and confirmed to apply properly and
build properly against the relevant versions of src:golang if dropped
in debian/patches/ and referenced from debian/patches/series
appropriately. :)

What are the next steps here?  I'm still only a DM, so I don't think I
can make the relevant uploads myself (unless DMUA works for security
uploads too?), but I'm happy to stage everything in Git/elsewhere if
that'd be helpful!

♥,
- Tianon
  4096R / B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4

Message #45 received at 795106@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Tianon Gravi <admwiggin@gmail.com>, 795106@bugs.debian.org

Cc: Paul Tagliamonte <paultag@debian.org>

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Mon, 14 Sep 2015 17:42:13 +0200

Hi Tianon, hi Paul

Apologies for not having replied earlier, this fall somehow through
the cracks.

On Tue, Aug 11, 2015 at 10:35:02PM -0700, Tianon Gravi wrote:
> On 11 August 2015 at 22:22, Tianon Gravi <admwiggin@gmail.com> wrote:
> > I haven't been able to verify proper compilation with this one yet, however.  That's my next goal.
> 
> Ok, all patches have been tested and confirmed to apply properly and
> build properly against the relevant versions of src:golang if dropped
> in debian/patches/ and referenced from debian/patches/series
> appropriately. :)
> 
> What are the next steps here?  I'm still only a DM, so I don't think I
> can make the relevant uploads myself (unless DMUA works for security
> uploads too?), but I'm happy to stage everything in Git/elsewhere if
> that'd be helpful!

Can you fix this in unstable? For jessie: I guess these can be
considered low severity and don't need to be updated through a DSA.
Can you contact the release team to update it via a spu?

Btw, am I correct that as well reverse dependecies of golang (using
net/http part) now would need a rebuild once these issues are fixed?

Regards,
Salvatore

Message #50 received at 795106@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <admwiggin@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 795106@bugs.debian.org, Paul Tagliamonte <paultag@debian.org>

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Mon, 14 Sep 2015 08:46:23 -0700

On 14 September 2015 at 08:42, Salvatore Bonaccorso <carnil@debian.org> wrote:
> Can you fix this in unstable? For jessie: I guess these can be
> considered low severity and don't need to be updated through a DSA.
> Can you contact the release team to update it via a spu?

Sure, fixing in unstable's pretty easy. :)

I'm also a DD now, so if there's more process you'd like me to follow
on top of that, I'm happy to give it a shot, but I'll need a little
guidance. :)

> Btw, am I correct that as well reverse dependecies of golang (using
> net/http part) now would need a rebuild once these issues are fixed?

Yeah, that's correct, but only technically rev-deps that aren't
arch:all (since those are the -dev deps that only contain source).

♥,
- Tianon
  4096R / B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4

Message #55 received at 795106-close@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <tianon@debian.org>

To: 795106-close@bugs.debian.org

Subject: Bug#795106: fixed in golang 2:1.4.2-4

Date: Mon, 14 Sep 2015 21:24:10 +0000

Source: golang
Source-Version: 2:1.4.2-4

We believe that the bug you reported is fixed in the latest version of
golang, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 795106@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tianon Gravi <tianon@debian.org> (supplier of updated golang package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 14 Sep 2015 12:27:57 -0700
Source: golang
Binary: golang-go golang-src golang-doc golang golang-go-linux-amd64 golang-go-linux-arm golang-go-linux-386 golang-go-freebsd-amd64 golang-go-freebsd-arm golang-go-freebsd-386 golang-go-windows-amd64 golang-go-windows-386 golang-go-darwin-amd64 golang-go-darwin-386 golang-go-netbsd-amd64 golang-go-netbsd-386
Architecture: source all amd64
Version: 2:1.4.2-4
Distribution: unstable
Urgency: high
Maintainer: Go Compiler Team <pkg-golang-devel@lists.alioth.debian.org>
Changed-By: Tianon Gravi <tianon@debian.org>
Description:
 golang     - Go programming language compiler - metapackage
 golang-doc - Go programming language compiler - documentation
 golang-go  - Go programming language compiler
 golang-go-darwin-386 - Go standard library compiled for darwin_386
 golang-go-darwin-amd64 - Go standard library compiled for darwin_amd64
 golang-go-freebsd-386 - Go standard library compiled for freebsd_386
 golang-go-freebsd-amd64 - Go standard library compiled for freebsd_amd64
 golang-go-freebsd-arm - Go standard library compiled for freebsd_arm
 golang-go-linux-386 - Go standard library compiled for linux_386
 golang-go-linux-amd64 - Go standard library compiled for linux_amd64
 golang-go-linux-arm - Go standard library compiled for linux_arm
 golang-go-netbsd-386 - Go standard library compiled for netbsd_386
 golang-go-netbsd-amd64 - Go standard library compiled for netbsd_amd64
 golang-go-windows-386 - Go standard library compiled for windows_386
 golang-go-windows-amd64 - Go standard library compiled for windows_amd64
 golang-src - Go programming language compiler - source files
Closes: 795106
Changes:
 golang (2:1.4.2-4) unstable; urgency=high
 .
   * Apply backported CVE fixes (Closes: #795106).
     - CVE-2015-5739: Invalid headers are parsed as valid headers
     - CVE-2015-5740: RFC 7230 3.3.3 4 violation
     - CVE-2015-5741: other discoveries of security-relevant RFC 7230 violations
Checksums-Sha1:
 84783c219a650e917ed7e34cfc00ad7916d37aaa 3179 golang_1.4.2-4.dsc
 9ecf5a677e49f123452240604fbcd08dab775a99 41488 golang_1.4.2-4.debian.tar.xz
 68a98cd9e5feacf0317525ff9327950f9906a379 2355356 golang-doc_1.4.2-4_all.deb
 46a7b55d3e101e25be985ed42dc10e3527c2af59 3899726 golang-go-darwin-386_1.4.2-4_all.deb
 8c9fe196cfe79667036af335927015c47b348faf 4021724 golang-go-darwin-amd64_1.4.2-4_all.deb
 b1e781d7b1ecd53679d55f85c2f7a6ef4589afe8 3896978 golang-go-freebsd-386_1.4.2-4_all.deb
 1c8e52112233186b17c7e20f697ef9790ca6e443 4018574 golang-go-freebsd-amd64_1.4.2-4_all.deb
 cfabb4ef51257522bf1afb03f8f458eb7f6b96a1 3711002 golang-go-freebsd-arm_1.4.2-4_all.deb
 56e56732548e549e183f1360d983c059a4439666 3908406 golang-go-linux-386_1.4.2-4_amd64.deb
 8b1e80aa9b2a2949608b87a523b2cd920e8cad12 8696518 golang-go-linux-amd64_1.4.2-4_amd64.deb
 3dc664e10672e1ddb3b54f868aaba743871687ed 3719436 golang-go-linux-arm_1.4.2-4_amd64.deb
 9478eadfbca09fa67e28144a5005c4607a3775f7 3892936 golang-go-netbsd-386_1.4.2-4_all.deb
 af660619772e922cb47f323acddcc04f7944eab3 3944038 golang-go-netbsd-amd64_1.4.2-4_all.deb
 c8ed5a86bed01e6418cc8eba3d3013d0eaf7f2f7 3927906 golang-go-windows-386_1.4.2-4_all.deb
 249c721990f28b86fd377de39cc0d1308c6cec4f 4066692 golang-go-windows-amd64_1.4.2-4_all.deb
 a736048fdb1cfdcb38649473254d3f437fc0f959 11724544 golang-go_1.4.2-4_amd64.deb
 19c712b55db8b8fa9a59602c02283f9182b3c838 5395722 golang-src_1.4.2-4_amd64.deb
 3bb7c37bf27611f1f4d6664a3e8ef87f6e7d9c74 25450 golang_1.4.2-4_all.deb
Checksums-Sha256:
 9b6df64585838d4e50431eb04775142f458ceffdd6e8490d3a09565c5e79910c 3179 golang_1.4.2-4.dsc
 46aaf39cdbfe0c3bb3a26f900aeec83d75f1844babc222dd6bec63169a295750 41488 golang_1.4.2-4.debian.tar.xz
 e505b04ea6371f07f99e53fe5ba31d11243a70b71b12c25a4eebb3726fe8dacc 2355356 golang-doc_1.4.2-4_all.deb
 be4d3ce6380f64bf77f53d61b79188d3ec120acd514eea4f70c0f32ff2213e39 3899726 golang-go-darwin-386_1.4.2-4_all.deb
 43e65e9ed548073f883b1af390984097a235b5d07e947abcc8dd11abaa2206ca 4021724 golang-go-darwin-amd64_1.4.2-4_all.deb
 50a6d019b9a88202024a7335c6437921cdc52a648373aa39180f0dea201fc549 3896978 golang-go-freebsd-386_1.4.2-4_all.deb
 dcc823d49d8c2d0526c93b688e33847bef5909da69e3264a2568a03ca0920d1d 4018574 golang-go-freebsd-amd64_1.4.2-4_all.deb
 540542d427e000dc4ad29a40c429750c95c0eaf9aff2784fbe3a564b6c9a9771 3711002 golang-go-freebsd-arm_1.4.2-4_all.deb
 c0f7c9c9360ccda60f1efc7d885109a62aed8218fe79f603deed94149482ee4d 3908406 golang-go-linux-386_1.4.2-4_amd64.deb
 60b2009ee21f4b83efee2866fced9b4d3647938510ac084413a40cc422b6c3f3 8696518 golang-go-linux-amd64_1.4.2-4_amd64.deb
 cbbffb56e194a39642e7849efcf2dcee10b471d5d1eaf1722a9f2fef27951b79 3719436 golang-go-linux-arm_1.4.2-4_amd64.deb
 5b8eaeefe7e6b5d99048c6f6777f90f9be996fc7a278f70d0b49896615799100 3892936 golang-go-netbsd-386_1.4.2-4_all.deb
 fea861ec6d917f3d772ed863c7ec15e8e829f85ac54a872d15101893b2604de2 3944038 golang-go-netbsd-amd64_1.4.2-4_all.deb
 5c0dc3a6b3dd62cc83dec12343957443b5f4862bda8393b7d21bb9980ed00301 3927906 golang-go-windows-386_1.4.2-4_all.deb
 5c66a67cecd61322f179ce15802838dbeee910d8bec0f7197bd5c9072baf5a65 4066692 golang-go-windows-amd64_1.4.2-4_all.deb
 f62415d0b84ef1497cd4b8b78dfa69fdcefbad777aa643d2fe740e98fb00f180 11724544 golang-go_1.4.2-4_amd64.deb
 f1d16b6d9bdbbae410d14d87d2974bd8316f251b410ce77049e992786ab933e8 5395722 golang-src_1.4.2-4_amd64.deb
 75ca6c607e70280f9b69494092447a92027935ae453ee9936384bc2aa51386c4 25450 golang_1.4.2-4_all.deb
Files:
 ff60aee38b5eddd47c44a42c845a2312 3179 devel optional golang_1.4.2-4.dsc
 a13d8a6b84c3e77aa39c880aa2f4201c 41488 devel optional golang_1.4.2-4.debian.tar.xz
 19565a5ee630a6527c937dbe8b4bfe7e 2355356 doc optional golang-doc_1.4.2-4_all.deb
 320eed0da7d3ad91b733e1a86ebec7df 3899726 devel optional golang-go-darwin-386_1.4.2-4_all.deb
 e665d6371d70a942b2af160997b3e0a1 4021724 devel optional golang-go-darwin-amd64_1.4.2-4_all.deb
 c7e4d823b1360be9b724df6e6bca0703 3896978 devel optional golang-go-freebsd-386_1.4.2-4_all.deb
 fec578d1a9c632a7ee858c714c728b54 4018574 devel optional golang-go-freebsd-amd64_1.4.2-4_all.deb
 6704c8def4229be3481e1cf42eec3d46 3711002 devel optional golang-go-freebsd-arm_1.4.2-4_all.deb
 7652a1bfa697adaf4b3e893382dfe5c7 3908406 devel optional golang-go-linux-386_1.4.2-4_amd64.deb
 b5d00f712daa4d250afa3822a1005995 8696518 devel optional golang-go-linux-amd64_1.4.2-4_amd64.deb
 6926adaa9d1dba388e7bd67528637b94 3719436 devel optional golang-go-linux-arm_1.4.2-4_amd64.deb
 ab5bdd0de098032549ab49738db19aa0 3892936 devel optional golang-go-netbsd-386_1.4.2-4_all.deb
 ccbb0d4ec1cc44ac26d845a36e594dee 3944038 devel optional golang-go-netbsd-amd64_1.4.2-4_all.deb
 45f2ecc50ebacdd28fb3719b1b0d75ff 3927906 devel optional golang-go-windows-386_1.4.2-4_all.deb
 f6ecd2a1f944613f29b9b6a43cb3340e 4066692 devel optional golang-go-windows-amd64_1.4.2-4_all.deb
 122c8d4b4b64371263cf5d360385548d 11724544 devel optional golang-go_1.4.2-4_amd64.deb
 20746aabd641abe7fffd47f7057df7d2 5395722 devel optional golang-src_1.4.2-4_amd64.deb
 13adbecf7d119cbaf2a2601c2ad9eb07 25450 devel optional golang_1.4.2-4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJV9yOGAAoJEANqnCW/NX3Uf5oP+wSMI8E7VcT4Cttnnnb/I+PU
k8qXo/TPoEzO+ygEvuFdvm07RZg6xT9bZyMhAXYz8EArEvEz9bl4TeQSO0K8I399
K4oI4+DACSIwLM7jE+npDxy4Eq1Cjg5eHvDEnndadCcNDXEE5kqr/RojqLOEOY46
gq7H50jlVy4F62kFlfLF+HBxwmGHp8c41qmmA6iLtIuBgvwlxNnGVMk7NdeE2rGn
zhgiv4uXmquB3vJ2AD/NnmAwLZHn0f5L/I8s0/Y5TFIzjkjT6vPxoP0WaEGTqkRs
Ni038anD8BuYCFlTQgRebbpp8s7keaCJgphbBMbbkzZ7vEZWbKtWNfyHN1MVTaN+
PRq69Z/YL/IYJK0V8sF+/B0tk7objuFvdfO3Gj5iNTafRjwx8I8E1DiG+aomJuy6
Mgh7RakP7rB46JiROcGL3nykw9UPMkvPLLT2UfqAgoELfN+GtZrUCTSLcsDZZAQF
g9kFhmt5P9/1lpNEXRNWJaCYPoXBjePxjt2lrTLOMp+zfDYeyHte485cibTRDaj9
fbfjIPaP6sJtgcg4qodEaHbtxXg1LiddUfeDpIHYNrKYnQqvV1clbtDA/CuAaeA8
s1aIos8DyNQhcXaBdh4YPgF0PEuGSbWl0akYBXnbKYTtVPvvc1v4iDyLgTOBXMjz
3/tjSSZisopVnnIota2H
=IEL5
-----END PGP SIGNATURE-----

Message #60 received at 795106@bugs.debian.org (full text, mbox, reply):

From: Tianon Gravi <admwiggin@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 795106@bugs.debian.org, Paul Tagliamonte <paultag@debian.org>

Subject: Re: Bug#795106: golang: CVE-2015-5739 CVE-2015-5740 CVE-2015-5741

Date: Mon, 14 Sep 2015 17:22:33 -0700

On 14 September 2015 at 08:42, Salvatore Bonaccorso <carnil@debian.org> wrote:
> Can you contact the release team to update it via a spu?

Request/proposal filed in #799019. :)

♥,
- Tianon
  4096R / B42F 6819 007F 00F8 8E36  4FD4 036A 9C25 BF35 7DD4

Send a report that this bug log contains spam.