From 0bf6ffba437d90230eddc8950215e122680ef439 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 8 Nov 2023 18:34:11 +0100 Subject: [PATCH 1/2] update to go1.21.4 go1.21.4 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker, the runtime, the compiler, and the go/types, net/http, and runtime/cgo packages. See the Go 1.21.4 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.21.4+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.21.3...go1.21.4 from the security mailing: [security] Go 1.21.4 and Go 1.20.11 are released Hello gophers, We have just released Go versions 1.21.4 and 1.20.11, minor point releases. These minor releases include 2 security fixes following the security policy: - path/filepath: recognize `\??\` as a Root Local Device path prefix. On Windows, a path beginning with `\??\` is a Root Local Device path equivalent to a path beginning with `\\?\`. Paths with a `\??\` prefix may be used to access arbitrary locations on the system. For example, the path `\??\c:\x` is equivalent to the more common path c:\x. The filepath package did not recognize paths with a `\??\` prefix as special. Clean could convert a rooted path such as `\a\..\??\b` into the root local device path `\??\b`. It will now convert this path into `.\??\b`. `IsAbs` did not report paths beginning with `\??\` as absolute. It now does so. VolumeName now reports the `\??\` prefix as a volume name. `Join(`\`, `??`, `b`)` could convert a seemingly innocent sequence of path elements into the root local device path `\??\b`. It will now convert this to `\.\??\b`. This is CVE-2023-45283 and https://go.dev/issue/63713. - path/filepath: recognize device names with trailing spaces and superscripts The `IsLocal` function did not correctly detect reserved names in some cases: - reserved names followed by spaces, such as "COM1 ". - "COM" or "LPT" followed by a superscript 1, 2, or 3. `IsLocal` now correctly reports these names as non-local. This is CVE-2023-45284 and https://go.dev/issue/63713. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/.test.yml | 2 +- .github/workflows/.windows.yml | 2 +- .github/workflows/buildkit.yml | 2 +- .github/workflows/test.yml | 2 +- Dockerfile | 2 +- Dockerfile.simple | 2 +- Dockerfile.windows | 2 +- hack/dockerfiles/generate-files.Dockerfile | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml index 562f041bb9756..14ce01cc882b8 100644 --- a/.github/workflows/.test.yml +++ b/.github/workflows/.test.yml @@ -12,7 +12,7 @@ on: default: "graphdriver" env: - GO_VERSION: "1.21.3" + GO_VERSION: "1.21.4" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.3 ITG_CLI_MATRIX_SIZE: 6 diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml index 270551f74b0d0..53e98d0822f7e 100644 --- a/.github/workflows/.windows.yml +++ b/.github/workflows/.windows.yml @@ -19,7 +19,7 @@ on: default: false env: - GO_VERSION: "1.21.3" + GO_VERSION: "1.21.4" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.3 WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml index b307639e27ba3..87a7cc9b36e97 100644 --- a/.github/workflows/buildkit.yml +++ b/.github/workflows/buildkit.yml @@ -13,7 +13,7 @@ on: pull_request: env: - GO_VERSION: "1.21.3" + GO_VERSION: "1.21.4" DESTDIR: ./build jobs: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 30e4fec72177d..95d7bfade9fad 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -15,7 +15,7 @@ on: pull_request: env: - GO_VERSION: "1.21.3" + GO_VERSION: "1.21.4" jobs: validate-dco: diff --git a/Dockerfile b/Dockerfile index 9c14d09f3ad87..41763563fd41d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.21.3 +ARG GO_VERSION=1.21.4 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" ARG XX_VERSION=1.2.1 diff --git a/Dockerfile.simple b/Dockerfile.simple index 6e5939aea4d43..d35c9d8f3b315 100644 --- a/Dockerfile.simple +++ b/Dockerfile.simple @@ -5,7 +5,7 @@ # This represents the bare minimum required to build and test Docker. -ARG GO_VERSION=1.21.3 +ARG GO_VERSION=1.21.4 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" diff --git a/Dockerfile.windows b/Dockerfile.windows index d568154943351..50af73f879b74 100644 --- a/Dockerfile.windows +++ b/Dockerfile.windows @@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG} # Use PowerShell as the default shell SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] -ARG GO_VERSION=1.21.3 +ARG GO_VERSION=1.21.4 ARG GOTESTSUM_VERSION=v1.8.2 ARG GOWINRES_VERSION=v0.3.1 ARG CONTAINERD_VERSION=v1.7.9 diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile index 0e308dac392ba..e2633ea5bbe73 100644 --- a/hack/dockerfiles/generate-files.Dockerfile +++ b/hack/dockerfiles/generate-files.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.21.3 +ARG GO_VERSION=1.21.4 ARG BASE_DEBIAN_DISTRO="bookworm" ARG PROTOC_VERSION=3.11.4 From 862caf826c5cd99f0122ac8b858b958a456a5233 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 5 Dec 2023 23:27:58 +0100 Subject: [PATCH 2/2] update to go1.21.5 go1.21.5 (released 2023-12-05) includes security fixes to the go command, and the net/http and path/filepath packages, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/rand, net, os, and syscall packages. See the Go 1.21.5 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.21.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.21.4...go1.21.5 from the security mailing: [security] Go 1.21.5 and Go 1.20.12 are released Hello gophers, We have just released Go versions 1.21.5 and 1.20.12, minor point releases. These minor releases include 3 security fixes following the security policy: - net/http: limit chunked data overhead A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Thanks to Bartek Nowotarski for reporting this issue. This is CVE-2023-39326 and Go issue https://go.dev/issue/64433. - cmd/go: go get may unexpectedly fallback to insecure git Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). Thanks to David Leadbeater for reporting this issue. This is CVE-2023-45285 and Go issue https://go.dev/issue/63845. - path/filepath: retain trailing \ when cleaning paths like \\?\c:\ Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?\, resulting in filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other effects). The previous behavior has been restored. This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/.test.yml | 2 +- .github/workflows/.windows.yml | 2 +- .github/workflows/buildkit.yml | 2 +- .github/workflows/test.yml | 2 +- Dockerfile | 2 +- Dockerfile.simple | 2 +- Dockerfile.windows | 2 +- hack/dockerfiles/generate-files.Dockerfile | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml index 14ce01cc882b8..0f96ee895483a 100644 --- a/.github/workflows/.test.yml +++ b/.github/workflows/.test.yml @@ -12,7 +12,7 @@ on: default: "graphdriver" env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.3 ITG_CLI_MATRIX_SIZE: 6 diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml index 53e98d0822f7e..a027e282f5834 100644 --- a/.github/workflows/.windows.yml +++ b/.github/workflows/.windows.yml @@ -19,7 +19,7 @@ on: default: false env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.3 WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml index 87a7cc9b36e97..8e6cd93893df1 100644 --- a/.github/workflows/buildkit.yml +++ b/.github/workflows/buildkit.yml @@ -13,7 +13,7 @@ on: pull_request: env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" DESTDIR: ./build jobs: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 95d7bfade9fad..c07d24f2d05af 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -15,7 +15,7 @@ on: pull_request: env: - GO_VERSION: "1.21.4" + GO_VERSION: "1.21.5" jobs: validate-dco: diff --git a/Dockerfile b/Dockerfile index 41763563fd41d..bacfeb70c70f5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" ARG XX_VERSION=1.2.1 diff --git a/Dockerfile.simple b/Dockerfile.simple index d35c9d8f3b315..73bc2472b3106 100644 --- a/Dockerfile.simple +++ b/Dockerfile.simple @@ -5,7 +5,7 @@ # This represents the bare minimum required to build and test Docker. -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" diff --git a/Dockerfile.windows b/Dockerfile.windows index 50af73f879b74..bcf9a86a8eebb 100644 --- a/Dockerfile.windows +++ b/Dockerfile.windows @@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG} # Use PowerShell as the default shell SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG GOTESTSUM_VERSION=v1.8.2 ARG GOWINRES_VERSION=v0.3.1 ARG CONTAINERD_VERSION=v1.7.9 diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile index e2633ea5bbe73..91437ceac6021 100644 --- a/hack/dockerfiles/generate-files.Dockerfile +++ b/hack/dockerfiles/generate-files.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.21.4 +ARG GO_VERSION=1.21.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG PROTOC_VERSION=3.11.4