Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release/1.7] update to go1.20.12, test go1.21.5 #9352

Merged
merged 2 commits into from
Dec 8, 2023

Commits on Dec 5, 2023

  1. update to go1.20.11, test go1.21.4

    go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath
    package, as well as bug fixes to the linker and the net/http package. See the
    Go 1.20.11 milestone on our issue tracker for details:
    
    - https://github.com/golang/go/issues?q=milestone%3AGo1.20.11+label%3ACherryPickApproved
    - full diff: golang/go@go1.20.10...go1.20.11
    
    from the security mailing:
    
    [security] Go 1.21.4 and Go 1.20.11 are released
    
    Hello gophers,
    
    We have just released Go versions 1.21.4 and 1.20.11, minor point releases.
    
    These minor releases include 2 security fixes following the security policy:
    
    - path/filepath: recognize `\??\` as a Root Local Device path prefix.
    
      On Windows, a path beginning with `\??\` is a Root Local Device path equivalent
      to a path beginning with `\\?\`. Paths with a `\??\` prefix may be used to
      access arbitrary locations on the system. For example, the path `\??\c:\x`
      is equivalent to the more common path c:\x.
    
      The filepath package did not recognize paths with a `\??\` prefix as special.
    
      Clean could convert a rooted path such as `\a\..\??\b` into
      the root local device path `\??\b`. It will now convert this
      path into `.\??\b`.
    
      `IsAbs` did not report paths beginning with `\??\` as absolute.
      It now does so.
    
      VolumeName now reports the `\??\` prefix as a volume name.
    
      `Join(`\`, `??`, `b`)` could convert a seemingly innocent
      sequence of path elements into the root local device path
      `\??\b`. It will now convert this to `\.\??\b`.
    
      This is CVE-2023-45283 and https://go.dev/issue/63713.
    
    - path/filepath: recognize device names with trailing spaces and superscripts
    
      The `IsLocal` function did not correctly detect reserved names in some cases:
    
      - reserved names followed by spaces, such as "COM1 ".
      - "COM" or "LPT" followed by a superscript 1, 2, or 3.
    
      `IsLocal` now correctly reports these names as non-local.
    
      This is CVE-2023-45284 and https://go.dev/issue/63713.
    
    Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    thaJeztah committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    1ec1ae2 View commit details
    Browse the repository at this point in the history
  2. update to go1.20.12, test go1.21.5

    go1.20.12 (released 2023-12-05) includes security fixes to the go command,
    and the net/http and path/filepath packages, as well as bug fixes to the
    compiler and the go command. See the Go 1.20.12 milestone on our issue
    tracker for details:
    
    - https://github.com/golang/go/issues?q=milestone%3AGo1.20.12+label%3ACherryPickApproved
    - full diff: golang/go@go1.20.11...go1.20.12
    
    from the security mailing:
    
    [security] Go 1.21.5 and Go 1.20.12 are released
    
    Hello gophers,
    
    We have just released Go versions 1.21.5 and 1.20.12, minor point releases.
    
    These minor releases include 3 security fixes following the security policy:
    
    - net/http: limit chunked data overhead
    
      A malicious HTTP sender can use chunk extensions to cause a receiver
      reading from a request or response body to read many more bytes from
      the network than are in the body.
    
      A malicious HTTP client can further exploit this to cause a server to
      automatically read a large amount of data (up to about 1GiB) when a
      handler fails to read the entire body of a request.
    
      Chunk extensions are a little-used HTTP feature which permit including
      additional metadata in a request or response body sent using the chunked
      encoding. The net/http chunked encoding reader discards this metadata.
      A sender can exploit this by inserting a large metadata segment with
      each byte transferred. The chunk reader now produces an error if the
      ratio of real body to encoded bytes grows too small.
    
      Thanks to Bartek Nowotarski for reporting this issue.
    
      This is CVE-2023-39326 and Go issue https://go.dev/issue/64433.
    
    - cmd/go: go get may unexpectedly fallback to insecure git
    
      Using go get to fetch a module with the ".git" suffix may unexpectedly
      fallback to the insecure "git://" protocol if the module is unavailable
      via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE
      is not set for said module. This only affects users who are not using
      the module proxy and are fetching modules directly (i.e. GOPROXY=off).
    
      Thanks to David Leadbeater for reporting this issue.
    
      This is CVE-2023-45285 and Go issue https://go.dev/issue/63845.
    
    - path/filepath: retain trailing \ when cleaning paths like \\?\c:\
    
      Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the
      volume name in Windows paths starting with \\?\, resulting in
      filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among
      other effects). The previous behavior has been restored.
    
      This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028.
    
    Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    thaJeztah committed Dec 5, 2023
    Configuration menu
    Copy the full SHA
    0d31440 View commit details
    Browse the repository at this point in the history