security: fix CVE-2024-34157

[rolandshoemaker]

This is a PRIVATE issue for CVE-2024-34157, tracked in http://b/362587476 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/1421.

/cc @golang/security and @golang/release

[rolandshoemaker]

@gopherbot please open backport issues for this security fix.

[gopherbot]

Backport issue(s) opened: #69146 (for 1.22), #69147 (for 1.23).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gabyhelp]

Related Issues and Documentation

• security: fix CVE-2024-34156 #69139
• security: fix CVE-2024-34158 #69141
• security: fix CVE-2024-34155 #69138
• security: fix CVE-2023-39324 #63212 (closed)
• security: fix CVE-2023-45288 #66297 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[rolandshoemaker]

This issue is not needed.