[SOLVED] Golang and vulnerability

Jason.nix · 01-30-2024, 04:49 AM

Hello,
I want to use the Tor WebTunnel on a server and it requires GOlang to be installed. I did:

Code:

# apt install golang

And as you can see, a lot of packages want to be installed:

Code:

The following additional packages will be installed:
  binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-12
  fontconfig-config fonts-dejavu-core g++ g++-12 gcc gcc-12 golang-1.19
  golang-1.19-doc golang-1.19-go golang-1.19-src golang-doc golang-go
  golang-src libabsl20220623 libaom3 libasan8 libatomic1 libavif15 libbinutils
  libc-dev-bin libc-devtools libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0
  libctf0 libdav1d6 libde265-0 libdeflate0 libfontconfig1 libgav1-1
  libgcc-12-dev libgd3 libgomp1 libgprofng0 libheif1 libisl23 libitm1 libjbig0
  libjpeg62-turbo liblerc4 liblsan0 libmpc3 libmpfr6 libnsl-dev libnuma1
  libpkgconf3 libquadmath0 librav1e0 libstdc++-12-dev libsvtav1enc1 libtiff6
  libtirpc-dev libtsan2 libubsan1 libwebp7 libx265-199 libxpm4 libyuv0
  linux-libc-dev manpages-dev pkg-config pkgconf pkgconf-bin rpcsvc-proto
Suggested packages:
  binutils-doc cpp-doc gcc-12-locales cpp-12-doc g++-multilib g++-12-multilib
  gcc-12-doc gcc-multilib make autoconf automake libtool flex bison gdb
  gcc-doc gcc-12-multilib bzr | brz git mercurial subversion glibc-doc
  libgd-tools libstdc++-12-doc
The following NEW packages will be installed:
  binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-12
  fontconfig-config fonts-dejavu-core g++ g++-12 gcc gcc-12 golang golang-1.19
  golang-1.19-doc golang-1.19-go golang-1.19-src golang-doc golang-go
  golang-src libabsl20220623 libaom3 libasan8 libatomic1 libavif15 libbinutils
  libc-dev-bin libc-devtools libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0
  libctf0 libdav1d6 libde265-0 libdeflate0 libfontconfig1 libgav1-1
  libgcc-12-dev libgd3 libgomp1 libgprofng0 libheif1 libisl23 libitm1 libjbig0
  libjpeg62-turbo liblerc4 liblsan0 libmpc3 libmpfr6 libnsl-dev libnuma1
  libpkgconf3 libquadmath0 librav1e0 libstdc++-12-dev libsvtav1enc1 libtiff6
  libtirpc-dev libtsan2 libubsan1 libwebp7 libx265-199 libxpm4 libyuv0
  linux-libc-dev manpages-dev pkg-config pkgconf pkgconf-bin rpcsvc-proto
0 upgraded, 71 newly installed, 0 to remove and 0 not upgraded.
Need to get 157 MB of archives.

Don't these packages create a security problem on an internet server?

Thank you.

hazel · 01-30-2024, 05:40 AM

Most of those that I recognise are build tools. A lot of them are parts of gcc or gcc libraries. I doubt if those would be a security risk.

Jason.nix · 01-31-2024, 01:51 AM

Quote:

Originally Posted by hazel

Most of those that I recognise are build tools. A lot of them are parts of gcc or gcc libraries. I doubt if those would be a security risk.

Hello,
Thank you so much.