Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Request: Cut new Go caddy version to address quic-go <0.42.0 CVE #6210

Closed
BBKolton opened this issue Apr 2, 2024 · 3 comments
Closed

Request: Cut new Go caddy version to address quic-go <0.42.0 CVE #6210

BBKolton opened this issue Apr 2, 2024 · 3 comments

Comments

@BBKolton
Copy link

BBKolton commented Apr 2, 2024 •
edited

An older version of quic-go has a CVE issued for versions <0.42.0 GHSA-c33x-xqrf-c478

Thanks to 32f7dd4, caddy is already up-to-date with the latest quic-go, 0.42.0. However, it's not possible to upgrade quic-go in consumers of caddy, as the new quic-go version breaks caddy @v2.7.6.

I humbly request that the maintainers cut a new version of caddy ASAP that includes the above referenced commit so that consumers of this repo can fix our CVE warnings :)
@BBKolton BBKolton changed the title Request: Cut new caddy-go version to address quic-go <0.42.0 CVE Request: Cut new Go caddy version to address quic-go <0.42.0 CVE Apr 2, 2024
@mohammed90
Copy link
Member

We're planning on cutting a release soon, though not specifically for this dep upgrade. Users who cannot wait for the release can build Caddy from HEAD or the commit 32f7dd4 using xcaddy:

xcaddy build 32f7dd4

LeSuisse pushed a commit to Enalean/tuleap that referenced this issue Apr 3, 2024
@vaceletm
Silent OSV on quic-go bump
d5a09fc 
There is nothing we can do on our and, we have to
wait for Caddy releases:
caddyserver/caddy#6210

Silent for a week to keep it under scrutinity.

Part of: request #37550 github.com/quic-go/quic-go 0.40.1 -> 0.42

Change-Id: Idf6d1af4ba83b0a1941c2a7c67e2bf42773058f4
@BBKolton
Copy link
Author

BBKolton commented Apr 3, 2024

Thank you for the quick response! I'll use the commit you listed in the meantime. Do you have a rough estimate for when the release might be made?

@francislavoie
Copy link
Member

See #6209 (comment)

@bdon bdon mentioned this issue Apr 4, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@francislavoie @mohammed90 @BBKolton