Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Compiling error: http: invalid Host header #4437

Closed
ElectricPulse opened this issue Jul 16, 2023 · 13 comments
Closed

Compiling error: http: invalid Host header #4437

ElectricPulse opened this issue Jul 16, 2023 · 13 comments

Comments

@ElectricPulse
Copy link

Description

I am trying to build docker-cli from source for my freebsd 13.2 host system, because currently my whole docker toolchain over at freebsd is a mess. I am aware that I can compile docker-cli without docker, but didn't yet bother to try it so the following is an attempt at bootstrapping it from Virtual Box with an arch linux VM. On the VM I installed docker, the docker-cli, docker-buildx (AUR). Upon launching docker buildx bake I get the following log:
build.txt
any further docker buildx bake results in just the error: http: invalid Host header being printed. Restarting the system clears the whole cache (which docker buildx prune apparently doesn't do) and the build command again returns the full log like the one attached.

PS. How should I link the binary so that it works with bsd's own libc implementation?

Reproduce

docker buildx bake

Expected behavior

No response

docker version

Client:
 Version:           24.0.2
 API version:       1.43
 Go version:        go1.20.4
 Git commit:        cb74dfcd85
 Built:             Mon May 29 15:50:06 2023
 OS/Arch:           linux/amd64
 Context:           default

Server:
 Engine:
  Version:          24.0.2
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.4
  Git commit:       659604f9ee
  Built:            Mon May 29 15:50:06 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.7.2
  GitCommit:        0cae528dd6cb557f7201036e9f43420650207b58.m
 runc:
  Version:          1.1.7
  GitCommit:        
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client:
 Version:    24.0.2
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  0.11.0
    Path:     /usr/lib/docker/cli-plugins/docker-buildx

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 1
 Server Version: 24.0.2
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: true
  Native Overlay Diff: false
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 0cae528dd6cb557f7201036e9f43420650207b58.m
 runc version: 
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.4.3-arch1-1
 Operating System: Arch Linux
 OSType: linux
 Architecture: x86_64
 CPUs: 1
 Total Memory: 6.13GiB
 Name: somehostname
 ID: d5fd4a52-a5ba-401b-aaa2-0cf7f8edcf26
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

Additional Info

The guest VM is connected to the internet via a bridge adapter

@nicks
Copy link
Contributor

nicks commented Jul 16, 2023

You're probably hitting moby/moby#45935

@thaJeztah
Copy link
Member

Thanks for reporting!

Yup, this was a breaking change in Go1.20.6 / 1.19.11 (https://go.dev/issue/60374);

Which was fixed by moby/moby#45942, and backported to all release-branches, but not yet released.

Let me close this one in the meantime, but feel free to continue the conversation.

@ElectricPulse
Copy link
Author

Excuse my ignorance but to make sure:
It's a problem with the docker-engine I currently have installed, I should downgrade to a working version or compile it from scratch and then proceed to recompile docker-cli?

@thaJeztah
Copy link
Member

If you want to build the tagged release (24.0.4), then you must compile it with go1.20.5, which is the version of go that was used for that release;

ARG GO_VERSION=1.20.5

Or you can build from the "tip" of the 24.0 release branches, which already have the fix for this.

@thaJeztah
Copy link
Member

And if the issue is with a package that was provided by the Arch Linux packagers, then it's worth opening a ticket with them (we don't provide packages for arch linux on our download.docker.com package repositories).

@ElectricPulse
Copy link
Author

If you want to build the tagged release (24.0.4), then you must compile it with go1.20.5, which is the version of go that was used for that release;

ARG GO_VERSION=1.20.5

Or you can build from the "tip" of the 24.0 release branches, which already have the fix for this.

I still don't get it :(.

  1. By "compile" you mean using the go compiler directly without running docker buildx?

(docker buildx bake for me fails for all the branches above the 19.* release with the same "Host..." error.)

  1. If I am indeed suppose to use the go compiler directly where is the guide/build steps for that?

  2. To reiterate my previous post: I thought the command docker buildx might be failing because of the docker engine/client I currently have installed: is that the case?

@thaJeztah
Copy link
Member

Ah, sorry, think I missunderstood you; I thought you meant "I compiled a binary, and when using the binary, I got that error".

Yes, if you get this error when using docker buildx bake, then it looks like your version of Docker (and Buildx) are broken. If those are packages you installed from Arch Linux's package repository, it means that they have built broken packages (recompiled with a Go version that's not compatible). If possible, you can temporarily downgrade to an earlier version of their packages.

Fixes for Buildx have also been merged and backported, but are not yet in a tagged release (docker/buildx#1952), so until that's the case, compiling buildx with go1.20.6 will produce a non-functional binary.

@thaJeztah
Copy link
Member

docker 24.0.5 was tagged and released, which contains the compatibility fix for go1.20.6. I expect packages to be updated in the Arch Linux package repositories.

b-ran added a commit to b-ran/dots that referenced this issue Jul 27, 2023
connorfeeley added a commit to connorfeeley/dotfiles that referenced this issue Aug 2, 2023
(cherry picked from commit 34434afb365736d60715b9c2769e39bfaa5f016c)
@felipelalli
Copy link

felipelalli commented Aug 3, 2023

NixOS should the same update.

[nix-shell:~/wa/docker]$ sudo docker exec -it container zsh
http: invalid Host header
[nix-shell:~/wa/docker]$ docker --version
Docker version 20.10.25, build v20.10.25

Related: Docker fails to run containers #244159

@thaJeztah
Copy link
Member

jeffwidman added a commit to dependabot/cli that referenced this issue Aug 10, 2023
The upstream `moby` bug that triggered the temp pin has been fixed:
* #156
* docker/cli#4437

So no need to pin to specific patch versions anymore.

Update to `go` `1.21` while I was in there.
jeffwidman added a commit to dependabot/cli that referenced this issue Aug 15, 2023
The upstream `moby` bug that triggered the temp pin has been fixed:
* #156
* docker/cli#4437

So no need to pin to specific patch versions anymore.

Update to `go` `1.21` while I was in there.
jeffwidman added a commit to dependabot/cli that referenced this issue Aug 15, 2023
The upstream `moby` bug that triggered the temp pin has been fixed:
* #156
* docker/cli#4437

So no need to pin to specific patch versions anymore.

Update to `go` `1.21` while I was in there.
marwinski added a commit to marwinski/driverkit that referenced this issue Aug 31, 2023
This fixes a bug due to a breaking change in golang 1.20.6 / 1.19.11
which prevents the "driverkit docker" to run.

The docker issue is docker/cli#4437
@kayvansol

This comment was marked as off-topic.

@dhawansolanki
Copy link

Try : "DOCKER_BUILDKIT=0" before running your existing command.
For Eg : sudo DOCKER_BUILDKIT=0 docker-compose up --build -d

@thaJeztah
Copy link
Member

@dhawansolanki this ticket is about building the source in this repository, which requires BuildKit. Also this bug has been fixed in current versions of docker, so should no longer occur.

ddl-ebrown added a commit to ddl-ebrown/flytectl that referenced this issue Apr 22, 2024
 - Go 1.19 is no longer maintained - support ended on Sept 6 2023
   It's last release was go 1.19.13 and has since become subject to a
   number of security vulnerabilities.

 - Updating to go 1.21 from go 1.19 resolves core go 1.19 vulns present:

    ✗ HIGH CVE-2023-45287
      https://scout.docker.com/v/CVE-2023-45287?s=golang&n=stdlib&t=golang&vr=%3C1.20.0
      Affected range : <1.20.0
      Fixed version  : 1.20.0

    ✗ HIGH CVE-2023-45283
      https://scout.docker.com/v/CVE-2023-45283?s=golang&n=stdlib&t=golang&vr=%3C1.20.11
      Affected range : <1.20.11
      Fixed version  : 1.20.11

    ✗ HIGH CVE-2023-39325
      https://scout.docker.com/v/CVE-2023-39325?s=golang&n=stdlib&t=golang&vr=%3C1.20.10
      Affected range : <1.20.10
      Fixed version  : 1.20.10

    ✗ MEDIUM CVE-2023-29406
      https://scout.docker.com/v/CVE-2023-29406?s=golang&n=stdlib&t=golang&vr=%3C1.19.11
      Affected range : <1.19.11
      Fixed version  : 1.19.11

    ✗ MEDIUM CVE-2023-39319
      https://scout.docker.com/v/CVE-2023-39319?s=golang&n=stdlib&t=golang&vr=%3C1.20.8
      Affected range : <1.20.8
      Fixed version  : 1.20.8

    ✗ MEDIUM CVE-2023-39318
      https://scout.docker.com/v/CVE-2023-39318?s=golang&n=stdlib&t=golang&vr=%3C1.20.8
      Affected range : <1.20.8
      Fixed version  : 1.20.8

    ✗ MEDIUM CVE-2023-45284
      https://scout.docker.com/v/CVE-2023-45284?s=golang&n=stdlib&t=golang&vr=%3C1.20.11
      Affected range : <1.20.11
      Fixed version  : 1.20.11

    ✗ MEDIUM CVE-2023-39326
      https://scout.docker.com/v/CVE-2023-39326?s=golang&n=stdlib&t=golang&vr=%3C1.20.12
      Affected range : <1.20.12
      Fixed version  : 1.20.12

    ✗ MEDIUM CVE-2023-29409
      https://scout.docker.com/v/CVE-2023-29409?s=golang&n=stdlib&t=golang&vr=%3C1.19.12
      Affected range : <1.19.12
      Fixed version  : 1.19.12

    ✗ UNSPECIFIED CVE-2024-24785
      https://scout.docker.com/v/CVE-2024-24785?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2024-24784
      https://scout.docker.com/v/CVE-2024-24784?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2024-24783
      https://scout.docker.com/v/CVE-2024-24783?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45290
      https://scout.docker.com/v/CVE-2023-45290?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45289
      https://scout.docker.com/v/CVE-2023-45289?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45288
      https://scout.docker.com/v/CVE-2023-45288?s=golang&n=stdlib&t=golang&vr=%3C1.21.9
      Affected range : <1.21.9
      Fixed version  : 1.21.9

 - Also upgrades the docker package to 26.0.2 which removes the issue
   described in docker/cli#4437 and resolves
   vulnerabilities:

    ✗ HIGH CVE-2023-28840 [Unprotected Alternate Channel]
      https://scout.docker.com/v/CVE-2023-28840?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 7.5
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

    ✗ MEDIUM CVE-2024-24557 [Insufficient Verification of Data Authenticity]
      https://scout.docker.com/v/CVE-2024-24557?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C24.0.9
      Affected range : <24.0.9
      Fixed version  : 24.0.9
      CVSS Score     : 6.9
      CVSS Vector    : CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

    ✗ MEDIUM CVE-2023-28842 [Unprotected Alternate Channel]
      https://scout.docker.com/v/CVE-2023-28842?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 6.8
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

    ✗ MEDIUM CVE-2023-28841 [Missing Encryption of Sensitive Data]
      https://scout.docker.com/v/CVE-2023-28841?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 6.8
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

    ✗ MEDIUM CVE-2024-29018 [Incorrect Resource Transfer Between Spheres]
      https://scout.docker.com/v/CVE-2024-29018?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C23.0.11
      Affected range : <23.0.11
      Fixed version  : 23.0.11
      CVSS Score     : 5.9
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

    ✗ MEDIUM GHSA-jq35-85cj-fj4p
      https://scout.docker.com/v/GHSA-jq35-85cj-fj4p?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C20.10.27
      Affected range : <20.10.27
      Fixed version  : 24.0.7

    ✗ UNSPECIFIED GMS-2023-3981 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities]
      https://scout.docker.com/v/GMS-2023-3981?s=gitlab&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C20.10.27
      Affected range : <20.10.27
      Fixed version  : v24.0.7
ddl-ebrown added a commit to ddl-ebrown/flytectl that referenced this issue Apr 22, 2024
 - Go 1.19 is no longer maintained - support ended on Sept 6 2023
   It's last release was go 1.19.13 and has since become subject to a
   number of security vulnerabilities.

 - Updating to go 1.21 from go 1.19 resolves core go 1.19 vulns present:

    ✗ HIGH CVE-2023-45287
      https://scout.docker.com/v/CVE-2023-45287?s=golang&n=stdlib&t=golang&vr=%3C1.20.0
      Affected range : <1.20.0
      Fixed version  : 1.20.0

    ✗ HIGH CVE-2023-45283
      https://scout.docker.com/v/CVE-2023-45283?s=golang&n=stdlib&t=golang&vr=%3C1.20.11
      Affected range : <1.20.11
      Fixed version  : 1.20.11

    ✗ HIGH CVE-2023-39325
      https://scout.docker.com/v/CVE-2023-39325?s=golang&n=stdlib&t=golang&vr=%3C1.20.10
      Affected range : <1.20.10
      Fixed version  : 1.20.10

    ✗ MEDIUM CVE-2023-29406
      https://scout.docker.com/v/CVE-2023-29406?s=golang&n=stdlib&t=golang&vr=%3C1.19.11
      Affected range : <1.19.11
      Fixed version  : 1.19.11

    ✗ MEDIUM CVE-2023-39319
      https://scout.docker.com/v/CVE-2023-39319?s=golang&n=stdlib&t=golang&vr=%3C1.20.8
      Affected range : <1.20.8
      Fixed version  : 1.20.8

    ✗ MEDIUM CVE-2023-39318
      https://scout.docker.com/v/CVE-2023-39318?s=golang&n=stdlib&t=golang&vr=%3C1.20.8
      Affected range : <1.20.8
      Fixed version  : 1.20.8

    ✗ MEDIUM CVE-2023-45284
      https://scout.docker.com/v/CVE-2023-45284?s=golang&n=stdlib&t=golang&vr=%3C1.20.11
      Affected range : <1.20.11
      Fixed version  : 1.20.11

    ✗ MEDIUM CVE-2023-39326
      https://scout.docker.com/v/CVE-2023-39326?s=golang&n=stdlib&t=golang&vr=%3C1.20.12
      Affected range : <1.20.12
      Fixed version  : 1.20.12

    ✗ MEDIUM CVE-2023-29409
      https://scout.docker.com/v/CVE-2023-29409?s=golang&n=stdlib&t=golang&vr=%3C1.19.12
      Affected range : <1.19.12
      Fixed version  : 1.19.12

    ✗ UNSPECIFIED CVE-2024-24785
      https://scout.docker.com/v/CVE-2024-24785?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2024-24784
      https://scout.docker.com/v/CVE-2024-24784?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2024-24783
      https://scout.docker.com/v/CVE-2024-24783?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45290
      https://scout.docker.com/v/CVE-2023-45290?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45289
      https://scout.docker.com/v/CVE-2023-45289?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45288
      https://scout.docker.com/v/CVE-2023-45288?s=golang&n=stdlib&t=golang&vr=%3C1.21.9
      Affected range : <1.21.9
      Fixed version  : 1.21.9

 - Also upgrades the docker package to 26.0.2 which removes the issue
   described in docker/cli#4437 and resolves
   vulnerabilities:

    ✗ HIGH CVE-2023-28840 [Unprotected Alternate Channel]
      https://scout.docker.com/v/CVE-2023-28840?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 7.5
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

    ✗ MEDIUM CVE-2024-24557 [Insufficient Verification of Data Authenticity]
      https://scout.docker.com/v/CVE-2024-24557?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C24.0.9
      Affected range : <24.0.9
      Fixed version  : 24.0.9
      CVSS Score     : 6.9
      CVSS Vector    : CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

    ✗ MEDIUM CVE-2023-28842 [Unprotected Alternate Channel]
      https://scout.docker.com/v/CVE-2023-28842?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 6.8
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

    ✗ MEDIUM CVE-2023-28841 [Missing Encryption of Sensitive Data]
      https://scout.docker.com/v/CVE-2023-28841?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 6.8
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

    ✗ MEDIUM CVE-2024-29018 [Incorrect Resource Transfer Between Spheres]
      https://scout.docker.com/v/CVE-2024-29018?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C23.0.11
      Affected range : <23.0.11
      Fixed version  : 23.0.11
      CVSS Score     : 5.9
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

    ✗ MEDIUM GHSA-jq35-85cj-fj4p
      https://scout.docker.com/v/GHSA-jq35-85cj-fj4p?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C20.10.27
      Affected range : <20.10.27
      Fixed version  : 24.0.7

    ✗ UNSPECIFIED GMS-2023-3981 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities]
      https://scout.docker.com/v/GMS-2023-3981?s=gitlab&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C20.10.27
      Affected range : <20.10.27
      Fixed version  : v24.0.7

Signed-off-by: ddl-ebrown <ethan.brown@dominodatalab.com>
ddl-ebrown added a commit to ddl-ebrown/flytectl that referenced this issue Apr 22, 2024
 - Go 1.19 is no longer maintained - support ended on Sept 6 2023
   It's last release was go 1.19.13 and has since become subject to a
   number of security vulnerabilities.

 - Updating to go 1.21 from go 1.19 resolves core go 1.19 vulns present:

    ✗ HIGH CVE-2023-45287
      https://scout.docker.com/v/CVE-2023-45287?s=golang&n=stdlib&t=golang&vr=%3C1.20.0
      Affected range : <1.20.0
      Fixed version  : 1.20.0

    ✗ HIGH CVE-2023-45283
      https://scout.docker.com/v/CVE-2023-45283?s=golang&n=stdlib&t=golang&vr=%3C1.20.11
      Affected range : <1.20.11
      Fixed version  : 1.20.11

    ✗ HIGH CVE-2023-39325
      https://scout.docker.com/v/CVE-2023-39325?s=golang&n=stdlib&t=golang&vr=%3C1.20.10
      Affected range : <1.20.10
      Fixed version  : 1.20.10

    ✗ MEDIUM CVE-2023-29406
      https://scout.docker.com/v/CVE-2023-29406?s=golang&n=stdlib&t=golang&vr=%3C1.19.11
      Affected range : <1.19.11
      Fixed version  : 1.19.11

    ✗ MEDIUM CVE-2023-39319
      https://scout.docker.com/v/CVE-2023-39319?s=golang&n=stdlib&t=golang&vr=%3C1.20.8
      Affected range : <1.20.8
      Fixed version  : 1.20.8

    ✗ MEDIUM CVE-2023-39318
      https://scout.docker.com/v/CVE-2023-39318?s=golang&n=stdlib&t=golang&vr=%3C1.20.8
      Affected range : <1.20.8
      Fixed version  : 1.20.8

    ✗ MEDIUM CVE-2023-45284
      https://scout.docker.com/v/CVE-2023-45284?s=golang&n=stdlib&t=golang&vr=%3C1.20.11
      Affected range : <1.20.11
      Fixed version  : 1.20.11

    ✗ MEDIUM CVE-2023-39326
      https://scout.docker.com/v/CVE-2023-39326?s=golang&n=stdlib&t=golang&vr=%3C1.20.12
      Affected range : <1.20.12
      Fixed version  : 1.20.12

    ✗ MEDIUM CVE-2023-29409
      https://scout.docker.com/v/CVE-2023-29409?s=golang&n=stdlib&t=golang&vr=%3C1.19.12
      Affected range : <1.19.12
      Fixed version  : 1.19.12

    ✗ UNSPECIFIED CVE-2024-24785
      https://scout.docker.com/v/CVE-2024-24785?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2024-24784
      https://scout.docker.com/v/CVE-2024-24784?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2024-24783
      https://scout.docker.com/v/CVE-2024-24783?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45290
      https://scout.docker.com/v/CVE-2023-45290?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45289
      https://scout.docker.com/v/CVE-2023-45289?s=golang&n=stdlib&t=golang&vr=%3C1.21.8
      Affected range : <1.21.8
      Fixed version  : 1.21.8

    ✗ UNSPECIFIED CVE-2023-45288
      https://scout.docker.com/v/CVE-2023-45288?s=golang&n=stdlib&t=golang&vr=%3C1.21.9
      Affected range : <1.21.9
      Fixed version  : 1.21.9

 - Also upgrades the docker package to 26.0.2 which removes the issue
   described in docker/cli#4437 and resolves
   vulnerabilities:

    ✗ HIGH CVE-2023-28840 [Unprotected Alternate Channel]
      https://scout.docker.com/v/CVE-2023-28840?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 7.5
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

    ✗ MEDIUM CVE-2024-24557 [Insufficient Verification of Data Authenticity]
      https://scout.docker.com/v/CVE-2024-24557?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C24.0.9
      Affected range : <24.0.9
      Fixed version  : 24.0.9
      CVSS Score     : 6.9
      CVSS Vector    : CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L

    ✗ MEDIUM CVE-2023-28842 [Unprotected Alternate Channel]
      https://scout.docker.com/v/CVE-2023-28842?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 6.8
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

    ✗ MEDIUM CVE-2023-28841 [Missing Encryption of Sensitive Data]
      https://scout.docker.com/v/CVE-2023-28841?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3E%3D1.12.0%2C%3C20.10.24
      Affected range : >=1.12.0
                     : <20.10.24
      Fixed version  : 20.10.24
      CVSS Score     : 6.8
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

    ✗ MEDIUM CVE-2024-29018 [Incorrect Resource Transfer Between Spheres]
      https://scout.docker.com/v/CVE-2024-29018?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C23.0.11
      Affected range : <23.0.11
      Fixed version  : 23.0.11
      CVSS Score     : 5.9
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

    ✗ MEDIUM GHSA-jq35-85cj-fj4p
      https://scout.docker.com/v/GHSA-jq35-85cj-fj4p?s=github&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C20.10.27
      Affected range : <20.10.27
      Fixed version  : 24.0.7

    ✗ UNSPECIFIED GMS-2023-3981 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities]
      https://scout.docker.com/v/GMS-2023-3981?s=gitlab&n=docker&ns=github.com%2Fdocker&t=golang&vr=%3C20.10.27
      Affected range : <20.10.27
      Fixed version  : v24.0.7

 - Run go mod tidy to pick up other related dependency bumps

Signed-off-by: ddl-ebrown <ethan.brown@dominodatalab.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

6 participants