File _patchinfo of Package patchinfo.14135

<patchinfo incident="14135">
  <issue tracker="bnc" id="1149259">go1.13 release tracking</issue>
  <issue tracker="bnc" id="1149638">Go rpm package spec define NO_BRP_STRIP_DEBUG=true NO_BRP_AR=true to avoid sort.a(__.PKGDEF) sort.a(_go_.o): Unable to recognise the format of file: file format not recognized</issue>
  <issue tracker="bnc" id="1152082">VUL-0: CVE-2019-16276: golang: net/http: invalid headers are normalized, allowing request smuggling</issue>
  <issue tracker="bnc" id="1154402">VUL-0: CVE-2019-17596: golang: invalid public key causes panic in dsa.Verify</issue>
  <issue tracker="bnc" id="1164288">VUL-1: CVE-2020-7919: golang: malformed input to crypto/x509 or the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte can lead to a panic</issue>
  <issue tracker="cve" id="2019-16276"/>
  <issue tracker="cve" id="2019-17596"/>
  <issue tracker="cve" id="2020-7919"/>
  <packager>jfkw</packager>
  <rating>moderate</rating>
  <category>security</category>
  <summary>Security update for go1.13</summary>
  <description>This update for go1.13 fixes the following issues:

Security issues fixed:

- CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).
- CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).
- CVE-2020-7919: Fixed a panic in the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte (bsc#1164288).

Non-security issues fixed:

- Go was updated to version 1.13.8 (bsc#1149259).
</description>
</patchinfo>