FinalBlocker +1
FinalFE +1

bug 2310555 leads to CVE-2024-34156, rated 7.5. if Fedora 41 is affected, unclear to me, we should not ship Fedora 41 with this bug.
CVE info: https://access.redhat.com/security/cve/CVE-2024-34156.
Upstream issue: https://github.com/golang/go/issues/69139
fix pending upstream.

for reference, link to security response: https://bugzilla.redhat.com/show_bug.cgi?id=2310528

This has been fixed in Go versions 1.23.1 and 1.22.7
https://groups.google.com/g/golang-dev/c/S9POB9NCTdk

https://packages.fedoraproject.org/pkgs/golang/golang/

Apologies for the noise.

FinalBlocker -1
FinalFE -1

FinalBlocker -1

The golang toolchain isn't shipped in artifacts so users installing this will get a zero day upgrade.

FinalBlocker -1
FinalFE -1

If it's not on any media, I don't see a reason for a blocker.

FinalBlocker -1
FinalFE -1

AGREED RejectedFinalBlocker
AGREED RejectedFinalFE

Discussed during the 2024-10-21 blocker review meeting [1]:

This is rejected on the basis that the issues caused can be "satisfactorily resolved by a package update" (per the criteria). anything built with Go and persistently parsing untrusted input is probably some kind of system service which should be deployed only on an installed system. we are not aware of any likely context in which this vulnerability would be exposed in a live or installer environment.

[1] https://meetbot.fedoraproject.org/blocker-review_matrix_fedoraproject-org/2024-10-21/f41-blocker-review.2024-10-21-16.00.log.html

The following votes have been closed:

• Rejected FinalBlocker (+0, 0, -4)
  • -1 by augenauf, pbrobinson, sgallagh, nielsenb
• Rejected FinalFreezeException (+0, 0, -3)
  • -1 by augenauf, sgallagh, nielsenb

Release F41 is no longer tracked by BlockerBugs, closing this ticket.