From 862caf826c5cd99f0122ac8b858b958a456a5233 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 5 Dec 2023 23:27:58 +0100 Subject: [PATCH] update to go1.21.5 go1.21.5 (released 2023-12-05) includes security fixes to the go command, and the net/http and path/filepath packages, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/rand, net, os, and syscall packages. See the Go 1.21.5 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.21.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.21.4...go1.21.5 from the security mailing: [security] Go 1.21.5 and Go 1.20.12 are released Hello gophers, We have just released Go versions 1.21.5 and 1.20.12, minor point releases. These minor releases include 3 security fixes following the security policy: - net/http: limit chunked data overhead A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Thanks to Bartek Nowotarski for reporting this issue. This is CVE-2023-39326 and Go issue https://go.dev/issue/64433. - cmd/go: go get may unexpectedly fallback to insecure git Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). Thanks to David Leadbeater for reporting this issue. This is CVE-2023-45285 and Go issue https://go.dev/issue/63845. - path/filepath: retain trailing \ when cleaning paths like \\?\c:\ Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?\, resulting in filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other effects). The previous behavior has been restored. This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/.test.yml | 2 +- .github/workflows/.windows.yml | 2 +- .github/workflows/buildkit.yml | 2 +- .github/workflows/test.yml | 2 +- Dockerfile | 2 +- Dockerfile.simple | 2 +- Dockerfile.windows | 2 +- hack/dockerfiles/generate-files.Dockerfile | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml index 14ce01cc882b8b4e221d3dccfef4ba569c16b133..0f96ee895483a8b7e9475bad682049002bc17b56 100644 --- a/.github/workflows/.test.yml +++ b/.github/workflows/.test.yml @@ -12,7 +12,7 @@ on: default: "graphdriver" env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.3 ITG_CLI_MATRIX_SIZE: 6 diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml index 53e98d0822f7e445b213bb80f8a62ebd98da0f52..a027e282f583437dade7e86bc07ed684d34530f2 100644 --- a/.github/workflows/.windows.yml +++ b/.github/workflows/.windows.yml @@ -19,7 +19,7 @@ on: default: false env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.3 WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml index 87a7cc9b36e97eeea448d3fa1762c3f76702d77e..8e6cd93893df18a38ab15772c18937e0ef4a52a8 100644 --- a/.github/workflows/buildkit.yml +++ b/.github/workflows/buildkit.yml @@ -13,7 +13,7 @@ on: pull_request: env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" DESTDIR: ./build jobs: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 95d7bfade9fad49feac9d956c5ba667d570c3bb0..c07d24f2d05afb011e60954d6eb092af1c2ed904 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -15,7 +15,7 @@ on: pull_request: env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" jobs: validate-dco: diff --git a/Dockerfile b/Dockerfile index 41763563fd41d7f0d73cea0424106b4ad5e06767..bacfeb70c70f5683d7625e8c53ea23839861e1e9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" ARG XX_VERSION=1.2.1 diff --git a/Dockerfile.simple b/Dockerfile.simple index d35c9d8f3b31538e4cf6e02dbcd3cb5c56f015da..73bc2472b310644bfdf9ba2a9d9ba6f99b82988a 100644 --- a/Dockerfile.simple +++ b/Dockerfile.simple @@ -5,7 +5,7 @@ # This represents the bare minimum required to build and test Docker. -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" diff --git a/Dockerfile.windows b/Dockerfile.windows index 50af73f879b742662585e5787bedb703b8700731..bcf9a86a8eebb89b208c959f6117a41ec284bfd9 100644 --- a/Dockerfile.windows +++ b/Dockerfile.windows @@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG} # Use PowerShell as the default shell SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG GOTESTSUM_VERSION=v1.8.2 ARG GOWINRES_VERSION=v0.3.1 ARG CONTAINERD_VERSION=v1.7.9 diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile index e2633ea5bbe73c84c102687a9f59ee2a0b80b3c2..91437ceac6021132e51f4937884f4ee6c2410988 100644 --- a/hack/dockerfiles/generate-files.Dockerfile +++ b/hack/dockerfiles/generate-files.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG PROTOC_VERSION=3.11.4