From 862caf826c5cd99f0122ac8b858b958a456a5233 Mon Sep 17 00:00:00 2001
From: Sebastiaan van Stijn <github@gone.nl>
Date: Tue, 5 Dec 2023 23:27:58 +0100
Subject: [PATCH] update to go1.21.5
go1.21.5 (released 2023-12-05) includes security fixes to the go command,
and the net/http and path/filepath packages, as well as bug fixes to the
compiler, the go command, the runtime, and the crypto/rand, net, os, and
syscall packages. See the Go 1.21.5 milestone on our issue tracker for
details:
- https://github.com/golang/go/issues?q=milestone%3AGo1.21.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.21.4...go1.21.5
from the security mailing:
[security] Go 1.21.5 and Go 1.20.12 are released
Hello gophers,
We have just released Go versions 1.21.5 and 1.20.12, minor point releases.
These minor releases include 3 security fixes following the security policy:
- net/http: limit chunked data overhead
A malicious HTTP sender can use chunk extensions to cause a receiver
reading from a request or response body to read many more bytes from
the network than are in the body.
A malicious HTTP client can further exploit this to cause a server to
automatically read a large amount of data (up to about 1GiB) when a
handler fails to read the entire body of a request.
Chunk extensions are a little-used HTTP feature which permit including
additional metadata in a request or response body sent using the chunked
encoding. The net/http chunked encoding reader discards this metadata.
A sender can exploit this by inserting a large metadata segment with
each byte transferred. The chunk reader now produces an error if the
ratio of real body to encoded bytes grows too small.
Thanks to Bartek Nowotarski for reporting this issue.
This is CVE-2023-39326 and Go issue https://go.dev/issue/64433.
- cmd/go: go get may unexpectedly fallback to insecure git
Using go get to fetch a module with the ".git" suffix may unexpectedly
fallback to the insecure "git://" protocol if the module is unavailable
via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE
is not set for said module. This only affects users who are not using
the module proxy and are fetching modules directly (i.e. GOPROXY=off).
Thanks to David Leadbeater for reporting this issue.
This is CVE-2023-45285 and Go issue https://go.dev/issue/63845.
- path/filepath: retain trailing \ when cleaning paths like \\?\c:\
Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the
volume name in Windows paths starting with \\?\, resulting in
filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among
other effects). The previous behavior has been restored.
This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
---
.github/workflows/.test.yml | 2 +-
.github/workflows/.windows.yml | 2 +-
.github/workflows/buildkit.yml | 2 +-
.github/workflows/test.yml | 2 +-
Dockerfile | 2 +-
Dockerfile.simple | 2 +-
Dockerfile.windows | 2 +-
hack/dockerfiles/generate-files.Dockerfile | 2 +-
8 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml
index 14ce01cc88..0f96ee8954 100644
--- a/.github/workflows/.test.yml
+++ b/.github/workflows/.test.yml
@@ -12,7 +12,7 @@ on:
default: "graphdriver"
env:
- GO_VERSION: "1.21.4"
+ GO_VERSION: "1.21.5"
GOTESTLIST_VERSION: v0.3.1
TESTSTAT_VERSION: v0.1.3
ITG_CLI_MATRIX_SIZE: 6
diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml
index 53e98d0822..a027e282f5 100644
--- a/.github/workflows/.windows.yml
+++ b/.github/workflows/.windows.yml
@@ -19,7 +19,7 @@ on:
default: false
env:
- GO_VERSION: "1.21.4"
+ GO_VERSION: "1.21.5"
GOTESTLIST_VERSION: v0.3.1
TESTSTAT_VERSION: v0.1.3
WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore
diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml
index 87a7cc9b36..8e6cd93893 100644
--- a/.github/workflows/buildkit.yml
+++ b/.github/workflows/buildkit.yml
@@ -13,7 +13,7 @@ on:
pull_request:
env:
- GO_VERSION: "1.21.4"
+ GO_VERSION: "1.21.5"
DESTDIR: ./build
jobs:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 95d7bfade9..c07d24f2d0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,7 +15,7 @@ on:
pull_request:
env:
- GO_VERSION: "1.21.4"
+ GO_VERSION: "1.21.5"
jobs:
validate-dco:
diff --git a/Dockerfile b/Dockerfile
index 41763563fd..bacfeb70c7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1
-ARG GO_VERSION=1.21.4
+ARG GO_VERSION=1.21.5
ARG BASE_DEBIAN_DISTRO="bookworm"
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
ARG XX_VERSION=1.2.1
diff --git a/Dockerfile.simple b/Dockerfile.simple
index d35c9d8f3b..73bc2472b3 100644
--- a/Dockerfile.simple
+++ b/Dockerfile.simple
@@ -5,7 +5,7 @@
# This represents the bare minimum required to build and test Docker.
-ARG GO_VERSION=1.21.4
+ARG GO_VERSION=1.21.5
ARG BASE_DEBIAN_DISTRO="bookworm"
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
diff --git a/Dockerfile.windows b/Dockerfile.windows
index 50af73f879..bcf9a86a8e 100644
--- a/Dockerfile.windows
+++ b/Dockerfile.windows
@@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG}
# Use PowerShell as the default shell
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
-ARG GO_VERSION=1.21.4
+ARG GO_VERSION=1.21.5
ARG GOTESTSUM_VERSION=v1.8.2
ARG GOWINRES_VERSION=v0.3.1
ARG CONTAINERD_VERSION=v1.7.9
diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile
index e2633ea5bb..91437ceac6 100644
--- a/hack/dockerfiles/generate-files.Dockerfile
+++ b/hack/dockerfiles/generate-files.Dockerfile
@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1
-ARG GO_VERSION=1.21.4
+ARG GO_VERSION=1.21.5
ARG BASE_DEBIAN_DISTRO="bookworm"
ARG PROTOC_VERSION=3.11.4