Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release/1.5] update golang to 1.17.11 #7014

Merged
merged 1 commit into from Jun 2, 2022

Conversation

thaJeztah
Copy link
Member

go1.17.11 (released 2022-06-01) includes security fixes to the crypto/rand,
crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the
crypto/tls package. See the Go 1.17.11 milestone on our issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.17.11+label%3ACherryPickApproved

Hello gophers,

We have just released Go versions 1.18.3 and 1.17.11, minor point releases.

These minor releases include 4 security fixes following the security policy:

  • crypto/rand: rand.Read hangs with extremely large buffers
    On Windows, rand.Read will hang indefinitely if passed a buffer larger than
    1 << 32 - 1 bytes.

    Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset,
    for reporting this issue.

    This is CVE-2022-30634 and Go issue https://go.dev/issue/52561.

  • crypto/tls: session tickets lack random ticket_age_add
    Session tickets generated by crypto/tls did not contain a randomly generated
    ticket_age_add. This allows an attacker that can observe TLS handshakes to
    correlate successive connections by comparing ticket ages during session
    resumption.

    Thanks to GitHub user nervuri for reporting this.

    This is CVE-2022-30629 and Go issue https://go.dev/issue/52814.

  • os/exec: empty Cmd.Path can result in running unintended binary on Windows

    If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput
    are executed when Cmd.Path is unset and, in the working directory, there are
    binaries named either "..com" or "..exe", they will be executed.

    Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting
    this.

    This is CVE-2022-30580 and Go issue https://go.dev/issue/52574.

  • path/filepath: Clean(.\c:) returns c: on Windows

    On Windows, the filepath.Clean function could convert an invalid path to a
    valid, absolute path. For example, Clean(.\c:) returned c:.

    Thanks to Unrud for reporting this issue.

    This is CVE-2022-29804 and Go issue https://go.dev/issue/52476.

go1.17.11 (released 2022-06-01) includes security fixes to the crypto/rand,
crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the
crypto/tls package. See the Go 1.17.11 milestone on our issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.17.11+label%3ACherryPickApproved

Hello gophers,

We have just released Go versions 1.18.3 and 1.17.11, minor point releases.

These minor releases include 4 security fixes following the security policy:

- crypto/rand: rand.Read hangs with extremely large buffers
  On Windows, rand.Read will hang indefinitely if passed a buffer larger than
  1 << 32 - 1 bytes.

  Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset,
  for reporting this issue.

  This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561.
- crypto/tls: session tickets lack random ticket_age_add
  Session tickets generated by crypto/tls did not contain a randomly generated
  ticket_age_add. This allows an attacker that can observe TLS handshakes to
  correlate successive connections by comparing ticket ages during session
  resumption.

  Thanks to GitHub user nervuri for reporting this.

  This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814.
- `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows

  If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput`
  are executed when Cmd.Path is unset and, in the working directory, there are
  binaries named either "..com" or "..exe", they will be executed.

  Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting
  this.

  This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574.
- `path/filepath`: Clean(`.\c:`) returns `c:` on Windows

  On Windows, the `filepath.Clean` function could convert an invalid path to a
  valid, absolute path. For example, Clean(`.\c:`) returned `c:`.

  Thanks to Unrud for reporting this issue.

  This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476.

[CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634
[CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629
[CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580
[CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
estesp
estesp approved these changes Jun 2, 2022
Copy link
Member

@estesp estesp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dmcgowan dmcgowan merged commit 6b8cb51 into containerd:release/1.5 Jun 2, 2022
27 checks passed
@thaJeztah thaJeztah deleted the 1.5_bump_golang_1.17.11 branch June 2, 2022 20:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants