update: go

[dongsupark]

Name: go
CVEs: CVE-2024-34155, CVE-2024-34156, CVE-2024-34158
CVSSs: n/a, n/a, n/a
Action Needed: update to >= 1.23.1 or >= 1.22.7

Summary:

• CVE-2024-34155: go/parser: stack exhaustion in all Parse* functions. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
• CVE-2024-34156: encoding/gob: stack exhaustion in Decoder.Decode. Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
• CVE-2024-34158: go/build/constraint: stack exhaustion in Parse. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

See also https://groups.google.com/g/golang-announce/c/K-cEzDeCtpc.

As Flatcar has only Go 1.21, which is already EOL, these CVEs are blocked until Go could be updated to 1.22+.

refmap.gentoo: TBD