8638a196c5
- math/big: panic during recursive division of very large numbers A number of math/big.Int <https://pkg.go.dev/math/big#Int> methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD) can panic when provided crafted large inputs. For the panic to happen, the divisor or modulo argument must be larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures). Multiple math/big.Rat <https://pkg.go.dev/math/big#Rat> methods are similarly affected. crypto/rsa.VerifyPSS <https://pkg.go.dev/crypto/rsa#VerifyPSS>, crypto/rsa.VerifyPKCS1v15 <https://pkg.go.dev/crypto/rsa#VerifyPKCS1v15>, and crypto/dsa.Verify <https://pkg.go.dev/crypto/dsa#Verify> may panic when provided crafted public keys and signatures. crypto/ecdsa and crypto/elliptic operations may only be affected if custom CurveParams <https://pkg.go.dev/crypto/elliptic#CurveParams> with unusually large field sizes (several times larger than the largest supported curve, P-521) are in use. Using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don’t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request or during a golang.org/x/crypto/otr conversation. Parsing a golang.org/x/crypto/openpgp Entity or verifying a signature may crash. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key. This issue is CVE-2020-28362 and Go issue golang.org/issue/42552. - cmd/go: arbitrary code execution at build time through cgo The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code. This can be caused by malicious gcc flags specified via a #cgo directive, or by a malicious symbol name in a linked object file. These issues are CVE-2020-28367 and CVE-2020-28366, and Go issues golang.org/issue/42556 and golang.org/issue/42559 respectively.
69 lines
1.8 KiB
Makefile
69 lines
1.8 KiB
Makefile
# $NetBSD: version.mk,v 1.105 2020/11/13 18:45:50 bsiegert Exp $
|
|
|
|
#
|
|
# If bsd.prefs.mk is included before go-package.mk in a package, then this
|
|
# file must be included directly in the package prior to bsd.prefs.mk.
|
|
#
|
|
.include "go-vars.mk"
|
|
|
|
GO115_VERSION= 1.15.5
|
|
GO114_VERSION= 1.14.12
|
|
GO113_VERSION= 1.13.15
|
|
GO110_VERSION= 1.10.8
|
|
GO19_VERSION= 1.9.7
|
|
GO14_VERSION= 1.4.3
|
|
|
|
.include "../../mk/bsd.prefs.mk"
|
|
|
|
.if ${OPSYS} == "NetBSD" && ${OS_VERSION:M6.*}
|
|
# 1.9 is the last Go version to support NetBSD 6
|
|
GO_VERSION_DEFAULT?= 19
|
|
.elif ${OPSYS} == "Darwin" && ${OS_VERSION:R} < 14
|
|
# go 1.11 removed support for osx 10.8 and 10.9
|
|
# https://github.com/golang/go/issues/23122
|
|
# darwin version 13.4 is osx 10.9.5
|
|
GO_VERSION_DEFAULT?= 110
|
|
.else
|
|
GO_VERSION_DEFAULT?= 115
|
|
.endif
|
|
|
|
.if !empty(GO_VERSION_DEFAULT)
|
|
GOVERSSUFFIX= ${GO_VERSION_DEFAULT}
|
|
.endif
|
|
|
|
# How to find the Go tool
|
|
GO= ${PREFIX}/go${GOVERSSUFFIX}/bin/go
|
|
|
|
# Build dependency for Go
|
|
GO_PACKAGE_DEP= go${GOVERSSUFFIX}-${GO${GOVERSSUFFIX}_VERSION}*:../../lang/go${GOVERSSUFFIX}
|
|
|
|
ONLY_FOR_PLATFORM= *-*-i386 *-*-x86_64 *-*-earmv[67]hf *-*-aarch64
|
|
NOT_FOR_PLATFORM= SunOS-*-i386
|
|
.if ${MACHINE_ARCH} == "i386"
|
|
GOARCH= 386
|
|
GOCHAR= 8
|
|
.elif ${MACHINE_ARCH} == "x86_64"
|
|
GOARCH= amd64
|
|
GOCHAR= 6
|
|
.elif ${MACHINE_ARCH} == "earmv6hf" || ${MACHINE_ARCH} == "earmv7hf"
|
|
GOARCH= arm
|
|
GOCHAR= 5
|
|
.elif ${MACHINE_ARCH} == "aarch64"
|
|
GOARCH= arm64
|
|
GOOPT= GOARM=7
|
|
# GOHOSTARCH is being misdetected as arm on NetBSD. Unclear why.
|
|
GOOPT+= GOHOSTARCH=arm64
|
|
.endif
|
|
.if ${MACHINE_ARCH} == "earmv6hf"
|
|
GOOPT= GOARM=6
|
|
.elif ${MACHINE_ARCH} == "earmv7hf"
|
|
GOOPT= GOARM=7
|
|
.endif
|
|
GO_PLATFORM= ${LOWER_OPSYS}_${GOARCH}
|
|
PLIST_SUBST+= GO_PLATFORM=${GO_PLATFORM:Q} GOARCH=${GOARCH:Q}
|
|
PLIST_SUBST+= GOCHAR=${GOCHAR:Q}
|
|
|
|
PRINT_PLIST_AWK+= { sub("/${GO_PLATFORM}/", "/$${GO_PLATFORM}/") }
|
|
|
|
TOOLS_CREATE+= go
|
|
TOOLS_PATH.go= ${GO}
|