6905fe7488
go1.18.4 (released 2022-07-12) includes security fixes to the compress/gzip,
encoding/gob, encoding/xml, go/parser, io/fs, net/http, and path/filepath
packages, as well as bug fixes to the compiler, the go command, the linker,
the runtime, and the runtime/metrics package. See the Go 1.18.4 milestone on the
issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.18.4+label%3ACherryPickApproved
This update addresses:
CVE-2022-1705, CVE-2022-1962, CVE-2022-28131, CVE-2022-30630, CVE-2022-30631,
CVE-2022-30632, CVE-2022-30633, CVE-2022-30635, and CVE-2022-32148.
Full diff: https://github.com/golang/go/compare/go1.18.3...go1.18.4
From the security announcement;
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
We have just released Go versions 1.18.4 and 1.17.12, minor point releases. These
minor releases include 9 security fixes following the security policy:
- net/http: improper sanitization of Transfer-Encoding header
The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating
a "chunked" encoding. This could potentially allow for request smuggling, but
only if combined with an intermediate server that also improperly failed to
reject the header as invalid.
This is CVE-2022-1705 and https://go.dev/issue/53188.
- When `httputil.ReverseProxy.ServeHTTP` was called with a `Request.Header` map
containing a nil value for the X-Forwarded-For header, ReverseProxy would set
the client IP as the value of the X-Forwarded-For header, contrary to its
documentation. In the more usual case where a Director function set the
X-Forwarded-For header value to nil, ReverseProxy would leave the header
unmodified as expected.
This is https://go.dev/issue/53423 and CVE-2022-32148.
Thanks to Christian Mehlmauer for reporting this issue.
- compress/gzip: stack exhaustion in Reader.Read
Calling Reader.Read on an archive containing a large number of concatenated
0-length compressed files can cause a panic due to stack exhaustion.
This is CVE-2022-30631 and Go issue https://go.dev/issue/53168.
- encoding/xml: stack exhaustion in Unmarshal
Calling Unmarshal on a XML document into a Go struct which has a nested field
that uses the any field tag can cause a panic due to stack exhaustion.
This is CVE-2022-30633 and Go issue https://go.dev/issue/53611.
- encoding/xml: stack exhaustion in Decoder.Skip
Calling Decoder.Skip when parsing a deeply nested XML document can cause a
panic due to stack exhaustion. The Go Security team discovered this issue, and
it was independently reported by Juho Nurminen of Mattermost.
This is CVE-2022-28131 and Go issue https://go.dev/issue/53614.
- encoding/gob: stack exhaustion in Decoder.Decode
Calling Decoder.Decode on a message which contains deeply nested structures
can cause a panic due to stack exhaustion.
This is CVE-2022-30635 and Go issue https://go.dev/issue/53615.
- path/filepath: stack exhaustion in Glob
Calling Glob on a path which contains a large number of path separators can
cause a panic due to stack exhaustion.
Thanks to Juho Nurminen of Mattermost for reporting this issue.
This is CVE-2022-30632 and Go issue https://go.dev/issue/53416.
- io/fs: stack exhaustion in Glob
Calling Glob on a path which contains a large number of path separators can
cause a panic due to stack exhaustion.
This is CVE-2022-30630 and Go issue https://go.dev/issue/53415.
- go/parser: stack exhaustion in all Parse* functions
Calling any of the Parse functions on Go source code which contains deeply
nested types or declarations can cause a panic due to stack exhaustion.
Thanks to Juho Nurminen of Mattermost for reporting this issue.
This is CVE-2022-1962 and Go issue https://go.dev/issue/53616.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 34b8670b1a)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
85 lines
3.1 KiB
Docker
85 lines
3.1 KiB
Docker
ARG GO_VERSION=1.18.4
|
|
|
|
FROM golang:${GO_VERSION}-alpine AS base
|
|
ENV GO111MODULE=off
|
|
RUN apk --no-cache add \
|
|
bash \
|
|
btrfs-progs-dev \
|
|
build-base \
|
|
curl \
|
|
lvm2-dev \
|
|
jq
|
|
|
|
RUN mkdir -p /build/
|
|
RUN mkdir -p /go/src/github.com/docker/docker/
|
|
WORKDIR /go/src/github.com/docker/docker/
|
|
|
|
FROM base AS frozen-images
|
|
# Get useful and necessary Hub images so we can "docker load" locally instead of pulling
|
|
COPY contrib/download-frozen-image-v2.sh /
|
|
RUN /download-frozen-image-v2.sh /build \
|
|
busybox:latest@sha256:95cf004f559831017cdf4628aaf1bb30133677be8702a8c5f2994629f637a209 \
|
|
busybox:latest@sha256:95cf004f559831017cdf4628aaf1bb30133677be8702a8c5f2994629f637a209 \
|
|
debian:bullseye-slim@sha256:dacf278785a4daa9de07596ec739dbc07131e189942772210709c5c0777e8437 \
|
|
hello-world:latest@sha256:d58e752213a51785838f9eed2b7a498ffa1cb3aa7f946dda11af39286c3db9a9 \
|
|
arm32v7/hello-world:latest@sha256:50b8560ad574c779908da71f7ce370c0a2471c098d44d1c8f6b513c5a55eeeb1
|
|
# See also frozenImages in "testutil/environment/protect.go" (which needs to be updated when adding images to this list)
|
|
|
|
FROM base AS dockercli
|
|
COPY hack/dockerfile/install/install.sh ./install.sh
|
|
COPY hack/dockerfile/install/dockercli.installer ./
|
|
RUN PREFIX=/build ./install.sh dockercli
|
|
|
|
# TestDockerCLIBuildSuite dependency
|
|
FROM base AS contrib
|
|
COPY contrib/syscall-test /build/syscall-test
|
|
COPY contrib/httpserver/Dockerfile /build/httpserver/Dockerfile
|
|
COPY contrib/httpserver contrib/httpserver
|
|
RUN CGO_ENABLED=0 go build -buildmode=pie -o /build/httpserver/httpserver github.com/docker/docker/contrib/httpserver
|
|
|
|
# Build the integration tests and copy the resulting binaries to /build/tests
|
|
FROM base AS builder
|
|
|
|
# Set tag and add sources
|
|
COPY . .
|
|
# Copy test sources tests that use assert can print errors
|
|
RUN mkdir -p /build${PWD} && find integration integration-cli -name \*_test.go -exec cp --parents '{}' /build${PWD} \;
|
|
# Build and install test binaries
|
|
ARG DOCKER_GITCOMMIT=undefined
|
|
RUN hack/make.sh build-integration-test-binary
|
|
RUN mkdir -p /build/tests && find . -name test.main -exec cp --parents '{}' /build/tests \;
|
|
|
|
## Generate testing image
|
|
FROM alpine:3.10 as runner
|
|
|
|
ENV DOCKER_REMOTE_DAEMON=1
|
|
ENV DOCKER_INTEGRATION_DAEMON_DEST=/
|
|
ENTRYPOINT ["/scripts/run.sh"]
|
|
|
|
# Add an unprivileged user to be used for tests which need it
|
|
RUN addgroup docker && adduser -D -G docker unprivilegeduser -s /bin/ash
|
|
|
|
# GNU tar is used for generating the emptyfs image
|
|
RUN apk --no-cache add \
|
|
bash \
|
|
ca-certificates \
|
|
g++ \
|
|
git \
|
|
inetutils-ping \
|
|
iptables \
|
|
libcap2-bin \
|
|
pigz \
|
|
tar \
|
|
xz
|
|
|
|
COPY hack/test/e2e-run.sh /scripts/run.sh
|
|
COPY hack/make/.ensure-emptyfs /scripts/ensure-emptyfs.sh
|
|
|
|
COPY integration/testdata /tests/integration/testdata
|
|
COPY integration/build/testdata /tests/integration/build/testdata
|
|
COPY integration-cli/fixtures /tests/integration-cli/fixtures
|
|
|
|
COPY --from=frozen-images /build/ /docker-frozen-images
|
|
COPY --from=dockercli /build/ /usr/bin/
|
|
COPY --from=contrib /build/ /tests/contrib/
|
|
COPY --from=builder /build/ /
|