New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

go_1_10: 1.10 -> 1.10.1, g_1_9: 1.9.4 -> 1.9.5 #38233

Merged

Mic92 merged 2 commits into NixOS:master from andir:go_1_10_1

Apr 4, 2018

Commits on Mar 31, 2018

go_1_10: 1.10 -> 1.10.1

This updates go to the latest version of the golang 1.10 branch.
A few minor (but important) things are fixed in this version:

* CVE-2018-7187 - arbitrary code execution in `go get` (when used with
  --insecure) [1]
* Extended Key Usage verification in client certificate scenarios [3]
* a bunch of stability changes

The full list of changes can se been on GitHub [2] & [4].

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7187
[2] https://github.com/golang/go/issues?q=milestone%3AGo1.10.1
[3] golang/go#23884
[4] golang/go#24563

andir committed Mar 31, 2018

Commits on Apr 1, 2018

go_1_9: 1.9.4 -> 1.9.5

This is a maintenance bump of the golang 1.9 version.

Within the updates are a few bug fixes including an (extended?)
fix for CVE-2018-7187 [1].

The complete changelog is available at the golang GitHub project [2].

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7187
[2] https://github.com/golang/go/issues?q=milestone%3AGo1.9.5

andir committed Apr 1, 2018