Race condition in Go programming language - CVE-2020-15586

Vulnerability identifier: #VU31891

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15586

CWE-ID: CWE-362

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler. A remote attacker can exploit the race and cause a denial of service condition on the target system.

Go programming language
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Opensuse
faq (Red Hat package)
openshift-eventrouter (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
containernetworking-plugins (Red Hat package)
ior (Red Hat package)
servicemesh (Red Hat package)
servicemesh-operator (Red Hat package)
servicemesh-cni (Red Hat package)
ignition (Red Hat package)
cri-tools (Red Hat package)
podman (Red Hat package)
cri-o (Red Hat package)
golang-1.11 (Debian package)
buildah (Red Hat package)
go (Alpine package)
apb (Red Hat package)
servicemesh-prometheus (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
machine-config-daemon (Red Hat package)
openshift-clients (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
servicemesh-grafana (Red Hat package)
tini (Red Hat package)
skopeo (Red Hat package)
golang
go-toolset-1.13 (Red Hat package)
go-toolset-1.13-golang (Red Hat package)
kubefed-client (Red Hat package)
mcg (Red Hat package)
redhat-release-coreos (Red Hat package)
ObjectScale
Dell PowerProtect Cyber Recovery
Red Hat Developer Tools
Red Hat OpenShift GitOps
OpenShift Service Mesh
Red Hat OpenShift Serverless
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
QRadar Suite
Red Hat Advanced Cluster Management for Kubernetes
OpenShift Logging
IBM Robotic Process Automation
Netcool Operations Insight

Install updates from vendor's website.

Go programming language - addressed in versions 1.13.13, 1.14.5
faq (Red Hat package) - update to 0.0.6-5.el7
openshift-eventrouter (Red Hat package) - addressed in versions 0.2-5.git7c289cc.el7, 0.2-6.git7c289cc.el8
golang-github-prometheus-promu (Red Hat package) - addressed in versions 0.5.0-3.git642a960.el7, 0.5.0-3.git642a960.el8
containernetworking-plugins (Red Hat package) - addressed in versions 0.8.6-2.rhaos4.5.el7, 0.8.6-2.rhaos4.5.el8
ior (Red Hat package) - update to 1.1.11-2.el8
servicemesh (Red Hat package) - update to 1.1.11-2.el8
servicemesh-operator (Red Hat package) - update to 1.1.11-3.el8
servicemesh-cni (Red Hat package) - update to 1.1.11-2.el8
ignition (Red Hat package) - update to 0.35.1-12.rhaos4.5.gitb4d18ad.el8
ObjectScale - update to 1.3.0
cri-tools (Red Hat package) - addressed in versions 1.18.0-4.el7, 1.18.0-4.el8, 1.20.0-3.el7
podman (Red Hat package) - update to 1.9.3-2.rhaos4.5.el8
cri-o (Red Hat package) - addressed in versions 1.18.3-19.rhaos4.5.git9264b4f.el7, 1.18.3-19.rhaos4.5.git9264b4f.el8, 1.18.4-4.rhaos4.5.git6dee389.el7, 1.18.4-4.rhaos4.5.git6dee389.el8, 1.18.4-7.rhaos4.5.git572d9f7.el7, 1.18.4-7.rhaos4.5.git572d9f7.el8, 1.20.2-12.rhaos4.7.git9f7be76.el7, 1.20.2-12.rhaos4.7.git9f7be76.el8
OpenShift Service Mesh - update to 1.1.11
Migration Toolkit for Containers - update to 1.7.4
Red Hat OpenShift Serverless - update to 1.9.0
QRadar Suite - update to 1.10.17.0
golang-1.11 (Debian package) - update to 1.11.6-1+deb10u4
buildah (Red Hat package) - update to 1.11.6-9.rhaos4.5.el8
go (Alpine package) - addressed in versions 1.13.13-r0, 1.13.14-r0
Red Hat Advanced Cluster Management for Kubernetes - update to 2.0.10
apb (Red Hat package) - update to 2.0.3-3.el7
servicemesh-prometheus (Red Hat package) - update to 2.14.0-20.el8
openshift-ansible (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.0.2755c9b.el7, 4.5.0-202010081312.p0.git.0.401534e.el7, 4.5.0-202011121956.p0.git.0.7093c82.el7, 4.6.0-202103192141.p0.git.0.d1b612b.el7, 4.7.0-202104250659.p0.git.e1b19c2.el7
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.15.d3ab88f.el7, 4.5.0-202010081312.p0.git.15.d7814b2.el7, 4.5.0-202011121956.p0.git.15.cccc412.el7, 4.7.0-202104260636.p0.git.330c6ef.el8
atomic-enterprise-service-catalog (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.1806.53dc206.el7, 4.5.0-202010081312.p0.git.1808.498e523.el7, 4.5.0-202011121956.p0.git.1808.0eb4933.el7
machine-config-daemon (Red Hat package) - addressed in versions 4.5.0-202010012007.p0.git.2570.fc7c941.el8, 4.5.0-202012050338.p0.git.2581.e7a62a7.el8
openshift-clients (Red Hat package) - addressed in versions 4.4.0-202011122017.p0.git.3445.6937a03.el7, 4.4.0-202011122017.p0.git.3445.6937a03.el8, 4.5.0-202010081312.p0.git.3607.908b350.el7, 4.5.0-202010081312.p0.git.3607.908b350.el8, 4.5.0-202011121956.p0.git.3609.b4952c1.el7, 4.5.0-202011121956.p0.git.3609.b4952c1.el8, 4.6.0-202103200039.p0.git.3841.3e951a5.el7, 4.6.0-202103200039.p0.git.3841.3e951a5.el8, 4.7.0-202104250659.p0.git.95881af.el7, 4.7.0-202104250659.p0.git.95881af.el8
openshift-kuryr (Red Hat package) - addressed in versions 4.5.0-202010091010.p0.git.1998.b73d461.el8, 4.5.0-202012022006.p0.git.2002.19b85d0.el8, 4.6.0-202103192141.p0.git.2234.cba9525.el8, 4.7.0-202104250659.p0.git.d49acc4.el8
Red Hat OpenShift Container Platform - addressed in versions 4.4.31, 4.5.20, 4.5.23, 4.5.34, 4.5.37, 4.6.23, 4.7.9, 4.7.13
openshift (Red Hat package) - addressed in versions 4.4.0-202011130111.p0.git.0.4861dfa.el7, 4.4.0-202011130111.p0.git.0.4861dfa.el8, 4.5.0-202010091010.p0.git.0.3538ccc.el7, 4.5.0-202010091010.p0.git.0.3538ccc.el8, 4.5.0-202011131403.p0.git.0.d153f8f.el7, 4.5.0-202011131403.p0.git.0.d153f8f.el8, 4.5.0-202012040353.p0.git.0.c2c4083.el7, 4.5.0-202012040353.p0.git.0.c2c4083.el8, 4.5.0-202102261511.p0.git.0.f0229b9.el7, 4.5.0-202102261511.p0.git.0.f0229b9.el8, 4.6.0-202103210832.p0.git.94284.834ccc7.el7, 4.6.0-202103210832.p0.git.94284.834ccc7.el8, 4.7.0-202104250659.p0.git.7d0a2b2.el7, 4.7.0-202104250659.p0.git.7d0a2b2.el8
jenkins-2-plugins (Red Hat package) - update to 4.7.1621361158-1.el8
OpenShift Logging - update to 5.0.3
servicemesh-grafana (Red Hat package) - update to 6.4.3-19.el8
IBM Robotic Process Automation - update to 21.0.3.1
tini (Red Hat package) - update to 0.18.0-5.el8
skopeo (Red Hat package) - update to 1.1.1-2.rhaos4.5.el8
Netcool Operations Insight - update to 1.6.6
golang - addressed in versions 1.13.14-1.el6, 1.13.14-1.el7, 1.13.14-1.fc31, 1.14.6-1.fc32
go-toolset-1.13 (Red Hat package) - update to 1.13.15-1.el7
go-toolset-1.13-golang (Red Hat package) - update to 1.13.15-3.el7
OpenShift Virtualization - addressed in versions 2.4.2, 4.9.0
kubefed-client (Red Hat package) - update to 4.5.0-202002271711.git.2.3bd46d6.el7
mcg (Red Hat package) - update to 5.6.0-39.2279a46.5.6.el8
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
redhat-release-coreos (Red Hat package) - update to 47.83-2.el8

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html
• https://groups.google.com/forum/#!topic/golang-announce/f2c5bqrGH_g
• https://groups.google.com/forum/#!topic/golang-announce/XZNfaiwgt2w
• https://www.cloudfoundry.org/blog/cve-2020-15586/

• OpenSUSE Linux update for go1.13
• Multiple vulnerabilities in Go
• OpenSUSE Linux update for go1.13
• Race condition in go (Alpine package)
• Amazon Linux AMI update for golang
• OpenSUSE Linux update for go1.14
• OpenSUSE Linux update for go1.14
• Red Hat Developer Tools update for go-toolset-1.13 and go-toolset-1.13-golang
• RHBA-2020:4229 - Bug Fix Advisory
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Red Hat OpenShift Container Platform update for golang
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Red Hat OpenShift Container Storage 4 update for mcg
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh
• Multiple vulnerabilities in OpenShift Serverless
• Debian update for golang-1.11
• Multiple vulnerabilities in OpenShift Container Platform 4.5
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in OpenShift Container Platform
• Multiple vulnerabilities in Red Hat Openshift Logging
• Multiple vulnerabilities in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in OpenShift Container Platform
• Red Hat OpenShift Virtualization update for golang
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.5 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.6
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in OpenShift Virtualization 2.4
• Fedora 32 update for golang
• Fedora 31 update for golang
• Fedora EPEL 7 update for golang
• Fedora EPEL 6 update for golang
• Multiple vulnerabilities in Dell ObjectScale