Bug 1187680

Summary:	VUL-0: go1.14,go1.15,go1.16: crypto/tls, enforce ALPN overlap when negotiated on both sides
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Gianluca Gabrielli <gianluca.gabrielli>
Component:	Incidents	Assignee:	Jeff Kowalczyk <jkowalczyk>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P2 - High	CC:	abergmann, andreas.taschner, meissner
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/302857
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-3618:7.4:(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Bug Depends on:
Bug Blocks:	1187678

Description Gianluca Gabrielli 2021-06-24 11:06:23 UTC

During the TLS handshake if the server doesn't support any of the
application protocols requested by the client, send the
no_application_protocol alert and abort the handshake on the server
side. This enforces the requirements of RFC 7301.

Comment 1 Gianluca Gabrielli 2021-06-24 11:06:58 UTC

Upstream patch: https://github.com/golang/go/commit/90d6bbbe42c15d444c1da0a1c293192d6f735a8e.patch

Comment 2 Gianluca Gabrielli 2021-06-24 11:55:21 UTC

Affected packages:
 - SUSE:SLE-15:Update/go1.14  1.14.15
 - SUSE:SLE-15:Update/go1.15  1.15.12
 - SUSE:SLE-15:Update/go1.16  1.16.4
 - openSUSE:Factory/go1.14    1.14.15
 - openSUSE:Factory/go1.15    1.15.13
 - openSUSE:Factory/go1.16    1.16.5

Comment 3 Gianluca Gabrielli 2021-09-28 11:44:36 UTC

This should have gotten fixed with version bump 1.6.17. Could if confirm and in case add the BZ id to the changes file?

Comment 4 Alexander Bergmann 2021-11-09 09:29:39 UTC

So far the fix from comment 1 is only present inside go1.17.

$ git tag --contains 90d6bbbe42c15d444c1da0a1c293192d6f735a8e
go1.17
go1.17.1
go1.17.2
go1.17.3
go1.17beta1
go1.17rc1
go1.17rc2

Comment 5 Gianluca Gabrielli 2022-01-11 13:06:27 UTC

Hi Jeff, can you please submit the patch?

Comment 6 Gianluca Gabrielli 2022-08-01 07:13:21 UTC

We now only support golang packages that already contains the fix. This bug can be closed