Debian Package Tracker

general

source: golang-1.8 (main)
version: 1.8.1-1
maintainer: Go Compiler Team (archive) [DMD]
uploaders: Michael Stapelberg [DMD] – Paul Tagliamonte [DMD] – Tianon Gravi [DMD] – Michael Hudson-Doyle [DMD]
arch: all amd64 arm64 armel armhf i386 ppc64 ppc64el s390x
std-ver: 3.9.8
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 1.8.1-1

versioned links

1.8.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-1.8
golang-1.8-doc
golang-1.8-go
golang-1.8-src

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

A new upstream version is available: 1.8.7 high

A new upstream version 1.8.7 is available, you should consider packaging it.

Created: 2018-01-26 Last update: 2019-01-20 08:12

0 new commits since last upload, time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.8.5-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

None

The Vcs URL is using anonscm.debian.org. Please update it for the move to salsa.debian.org.

Created: 2018-12-04 Last update: 2019-01-19 15:07

5 ignored security issues in stretch low

There are 5 open security issues in stretch.

5 issues skipped by the security teams:

CVE-2017-8932: A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated for specific input points. An adaptive attack can be mounted to progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to the derive correct output. This leads to a full key recovery attack against static ECDH, as used in popular JWT libraries.
CVE-2017-15041: Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."
CVE-2017-15042: An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.
CVE-2018-7187: The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
CVE-2018-6574: Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Please fix them.

Created: 2017-05-25 Last update: 2018-12-04 19:15

news

[rss feed]

[2018-12-04] Removed 1.8.5-1 from unstable (Debian FTP Masters)
[2018-12-04] Removed 1.8.4-1 from unstable (Debian FTP Masters)
[2018-12-04] Removed 1.8.3-1 from unstable (Debian FTP Masters)
[2017-12-06] golang-1.8 REMOVED from testing (Debian testing watch)
[2017-10-26] Accepted golang-1.8 1.8.5-1 (source) into unstable (Michael Hudson-Doyle)
[2017-10-06] Accepted golang-1.8 1.8.4-1 (source) into unstable (Michael Hudson-Doyle)
[2017-07-24] Accepted golang-1.8 1.8.3-2 (source) into unstable (Michael Stapelberg)
[2017-06-26] golang-1.8 1.8.3-1 MIGRATED to testing (Debian testing watch)
[2017-06-01] Accepted golang-1.8 1.8.3-1 (source) into unstable (Michael Hudson-Doyle)
[2017-05-25] golang-1.8 1.8.1-1 MIGRATED to testing (Debian testing watch)
[2017-04-10] Accepted golang-1.8 1.8.1-1 (source) into unstable (Michael Hudson-Doyle)
[2017-03-01] Accepted golang-1.8 1.8-1 (source) into unstable (Michael Hudson-Doyle)
[2017-02-06] golang-1.8 1.8~rc3-1 MIGRATED to testing (Debian testing watch)
[2017-01-26] Accepted golang-1.8 1.8~rc3-1 (source) into unstable (Michael Hudson-Doyle)
[2017-01-19] Accepted golang-1.8 1.8~rc2-1 (source) into unstable (Michael Hudson-Doyle)
[2017-01-16] Accepted golang-1.8 1.8~rc1-1 (source) into unstable (Michael Hudson-Doyle)
[2017-01-01] golang-1.8 1.8~beta2-1 MIGRATED to testing (Debian testing watch)
[2016-12-21] Accepted golang-1.8 1.8~beta2-1 (source) into unstable (Michael Hudson-Doyle)
[2016-12-12] Accepted golang-1.8 1.8~beta1-1 (source all amd64) into unstable, unstable (Michael Hudson-Doyle) (signed by: Tianon Gravi)

bugs [bug history graph]

all: 0

links

homepage
buildd: logs, clang
popcon
browse source code
edit tags
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.8.3-2ubuntu1
4 bugs
patches for 1.8.3-2ubuntu1