- Update to Go 1.11.3 (released 2018/12/13). This includes fixes to
the crypto/x509 and cmd/go packages. See the Go 1.11.3 milestone
on upstream tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.11.3
* bsc#1118897 CVE-2018-16873
go#29230 cmd/go: remote command execution during "go get -u"
* bsc#1118898 CVE-2018-16874
go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
* bsc#1118899 CVE-2018-16875
go#29233 crypto/x509: CPU denial of service
* Upstream is aware of a functionality regression in "go get" when
executed in GOPATH mode on an import path pattern containing "..."
(e.g., "go get github.com/golang/pkg/..."), when downloading
packages not already present in the GOPATH workspace. This is go#29241
and will be resolved in the next minor patch release go-1.11.4