From b8ac04fb522807ec4a946d6b03d73d261e083440 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Tue, 9 Apr 2024 17:16:12 +0200 Subject: [PATCH] update to go1.21.9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit go1.21.9 (released 2024-04-03) includes a security fix to the net/http package, as well as bug fixes to the linker, and the go/types and net/http packages. See the [Go 1.21.9 milestone](https://github.com/golang/go/issues?q=milestone%3AGo1.21.9+label%3ACherryPickApproved) for more details. These minor releases include 1 security fixes following the security policy: - http2: close connections when receiving too many headers Maintaining HPACK state requires that we parse and process all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, we don't allocate memory to store the excess headers but we do parse them. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. Set a limit on the amount of excess header frames we will process before closing a connection. Thanks to Bartek Nowotarski (https://nowotarski.info/) for reporting this issue. This is CVE-2023-45288 and Go issue https://go.dev/issue/65051. View the release notes for more information: https://go.dev/doc/devel/release#go1.21.9 - https://github.com/golang/go/issues?q=milestone%3AGo1.21.9+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.21.8...go1.21.9 Signed-off-by: Paweł Gronowski --- common.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common.mk b/common.mk index 71111f40b7..40f04a13bc 100644 --- a/common.mk +++ b/common.mk @@ -17,7 +17,7 @@ CHOWN:=docker run --rm -v $(CURDIR):/v -w /v alpine chown DEFAULT_PRODUCT_LICENSE:=Community Engine PACKAGER_NAME?= DOCKER_GITCOMMIT:=abcdefg -GO_VERSION:=1.21.8 +GO_VERSION:=1.21.9 PLATFORM=Docker Engine - Community SHELL:=/bin/bash VERSION?=0.0.1-dev