https://bugzilla.redhat.com/show_bug.cgi?id=1401985
Bug ID: 1401985
Summary: golang: net/http: multipart ReadForm close file after
copy
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: admiller(a)redhat.com, amurdaca(a)redhat.com,
aortega(a)redhat.com, apevec(a)redhat.com,
ayoung(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, chrisw(a)redhat.com,
cvsbot-xmlrpc(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jcajka(a)redhat.com, jgoulding(a)redhat.com,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jschluet(a)redhat.com, kbasil(a)redhat.com,
kseifried(a)redhat.com, lemenkov(a)gmail.com,
lhh(a)redhat.com, lmeyer(a)redhat.com, lpeer(a)redhat.com,
markmc(a)redhat.com, mmccomas(a)redhat.com,
rbryant(a)redhat.com, renich(a)woralelandia.com,
rhs-bugs(a)redhat.com, sclewis(a)redhat.com,
sgirijan(a)redhat.com, sisharma(a)redhat.com,
smohan(a)redhat.com, srevivo(a)redhat.com,
ssaha(a)redhat.com, s(a)shk.io,
storage-qa-internal(a)redhat.com, tdawson(a)redhat.com,
tdecacqu(a)redhat.com, vbatts(a)redhat.com,
vbellur(a)redhat.com
The net/http package's Request.ParseMultipartForm method starts writing to
temporary files once the request body size surpasses the given "maxMemory"
limit. It was possible for an attacker to generate a multipart request crafted
such that the server ran out of file descriptors.
Upstream bug:
https://github.com/golang/go/issues/17965
Upstream patch:
https://go-review.googlesource.com/#/c/30410/
External Reference:
https://groups.google.com/forum/#!msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1401987
Bug ID: 1401987
Summary: golang: net/http: multipart ReadForm close file after
copy [fedora-all]
Product: Fedora
Version: 25
Component: golang
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: vbatts(a)redhat.com
Reporter: amaris(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, amurdaca(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jcajka(a)redhat.com, lemenkov(a)gmail.com,
renich(a)woralelandia.com, s(a)shk.io, vbatts(a)redhat.com
Blocks: 1401985
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1401985
[Bug 1401985] golang: net/http: multipart ReadForm close file after copy
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1401988
Bug ID: 1401988
Summary: golang: net/http: multipart ReadForm close file after
copy [epel-all]
Product: Fedora EPEL
Version: el6
Component: golang
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: admiller(a)redhat.com
Reporter: amaris(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, amurdaca(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jcajka(a)redhat.com, s(a)shk.io
Blocks: 1401985
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only one tracking bug has been filed, please correct all affected versions
at the same time. If you need to fix the versions independent of each
other, you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1401985
[Bug 1401985] golang: net/http: multipart ReadForm close file after copy
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1367740
Bug ID: 1367740
Summary: golang-github-go-fsnotify-fsnotify FTBFS due to
failing tests on aarch64 d
Product: Fedora
Version: 25
Component: golang-github-go-fsnotify-fsnotify
Assignee: fpokorny(a)redhat.com
Reporter: pbrobinson(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fpokorny(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com
Blocks: 922257 (ARM64,F-ExcludeArch-aarch64)
http://arm.koji.fedoraproject.org/koji/taskinfo?taskID=3677865
golang-github-go-fsnotify-fsnotify-1.2.0-0.4.git96c060f.fc25
Executing(%check): /bin/sh -e /var/tmp/rpm-tmp.1pPWD0
+ umask 022
+ cd /builddir/build/BUILD
+ cd fsnotify-96c060f6a6b7e0d6f75fddd10efeaca3e5d1bcb0
+ export
GOPATH=/builddir/build/BUILDROOT/golang-github-go-fsnotify-fsnotify-1.2.0-0.4.git96c060f.fc25.aarch64//usr/share/gocode:/usr/share/gocode
+
GOPATH=/builddir/build/BUILDROOT/golang-github-go-fsnotify-fsnotify-1.2.0-0.4.git96c060f.fc25.aarch64//usr/share/gocode:/usr/share/gocode
+ go test -compiler gc -ldflags '' github.com/go-fsnotify/fsnotify
--- FAIL: TestPollerWithBadFd (0.14s)
inotify_poller_test.go:70: Expected EBADF, got: function not implemented
--- FAIL: TestPollerWithData (0.14s)
inotify_poller_test.go:62: Failed to create poller: function not
implemented
--- FAIL: TestPollerWithWakeup (0.14s)
inotify_poller_test.go:62: Failed to create poller: function not
implemented
--- FAIL: TestPollerWithClose (0.14s)
inotify_poller_test.go:62: Failed to create poller: function not
implemented
--- FAIL: TestPollerWithWakeupAndData (0.14s)
inotify_poller_test.go:62: Failed to create poller: function not
implemented
--- FAIL: TestPollerConcurrent (0.14s)
inotify_poller_test.go:62: Failed to create poller: function not
implemented
--- FAIL: TestInotifyCloseRightAway (0.14s)
inotify_test.go:20: Failed to create watcher
--- FAIL: TestInotifyCloseSlightlyLater (0.14s)
inotify_test.go:34: Failed to create watcher
--- FAIL: TestInotifyCloseSlightlyLaterWithWatch (0.14s)
inotify_test.go:52: Failed to create watcher
--- FAIL: TestInotifyCloseAfterRead (0.14s)
inotify_test.go:71: Failed to create watcher
--- FAIL: TestInotifyCloseCreate (0.00s)
inotify_test.go:117: Failed to create watcher: function not implemented
--- FAIL: TestInotifyStress (0.00s)
inotify_test.go:162: Failed to create watcher: function not implemented
--- FAIL: TestInotifyRemoveTwice (0.00s)
inotify_test.go:269: Failed to create watcher: function not implemented
--- FAIL: TestFsnotifyMultipleOperations (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyMultipleCreates (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyDirOnly (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyDeleteWatchedDir (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifySubDir (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyRename (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyRenameToCreate (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyRenameToOverwrite (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestRemovalOfWatch (0.09s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyAttrib (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyClose (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestFsnotifyFakeSymlink (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
--- FAIL: TestClose (0.00s)
integration_test.go:50: NewWatcher() failed: function not implemented
FAIL
FAIL github.com/go-fsnotify/fsnotify 1.466s
RPM build errors:
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=922257
[Bug 922257] Tracker for ARM64 support
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1360748
Bug ID: 1360748
Summary: update for s390x support
Product: Fedora
Version: rawhide
Component: golang-github-golang-sys
Assignee: fpokorny(a)redhat.com
Reporter: dan(a)danny.cz
QA Contact: extras-qa(a)fedoraproject.org
CC: fpokorny(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com
Blocks: 467765 (ZedoraTracker)
Please update to a recent snapshot to gather s390x support -
https://github.com/golang/sys/commit/33267e036fd93fcd26ea95b7bdaf2d8306cb74…
Version-Release number of selected component (if applicable):
golang-github-golang-sys-0-0.4.git9c60d1c.fc25
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=467765
[Bug 467765] Fedora for System z (s390): Bug Tracker
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1365467
Bug ID: 1365467
Summary: Tracker for golang-github-Azure-azure-sdk-for-go
Product: Fedora
Version: rawhide
Component: golang-github-Azure-azure-sdk-for-go
Assignee: fpokorny(a)redhat.com
Reporter: jchaloup(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fpokorny(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com
Tracker for async updates of golang-github-Azure-azure-sdk-for-go for rawhide
and other fedora distribution.
As golang devel packages are used only as a build-time dependency at the
moment, this tracker keeps updates and other information about this package,
e.g. broken dependencies, exceptions, important pieces of information and other
issues.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1362531
Bug ID: 1362531
Summary: Tracker for golang-github-golang-sys
Product: Fedora
Version: rawhide
Component: golang-github-golang-sys
Assignee: fpokorny(a)redhat.com
Reporter: jchaloup(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fpokorny(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com
Tracker for async updates of golang-github-golang-sys for rawhide and other
fedora distribution.
As golang devel packages are used only as a build-time dependency at the
moment, this tracker keeps updates and other information about this package,
e.g. broken dependencies, exceptions, important pieces of information and other
issues.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1404700
Bug ID: 1404700
Summary: rebase needed
Product: Fedora
Version: rawhide
Component: golang-github-onsi-gomega
Assignee: jchaloup(a)redhat.com
Reporter: lsm5(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-qa(a)fedoraproject.org, fpokorny(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com, vbatts(a)redhat.com
Blocks: 1404695
+++ This bug was initially created as a clone of Bug #1404698 +++
Description of problem:
current version doesn't seem to provide builddeps needed for blocked bug.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1404695
[Bug 1404695] Review Request: golang-github-containernetworking-cni -
networking for Linux containers
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1404698
Bug ID: 1404698
Summary: rebase needed
Product: Fedora
Version: rawhide
Component: golang-github-onsi-ginkgo
Assignee: jchaloup(a)redhat.com
Reporter: lsm5(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fpokorny(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com, vbatts(a)redhat.com
Blocks: 1404695
Description of problem:
current version doesn't seem to provide builddeps needed for blocked bug.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1404695
[Bug 1404695] Review Request: golang-github-containernetworking-cni -
networking for Linux containers
--
You are receiving this mail because:
You are on the CC list for the bug.