Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Tracking issue: Update to go1.11.5 and 1.10.8 #73238

Closed
5 tasks done
cblecker opened this issue Jan 24, 2019 · 11 comments
Closed
5 tasks done

Tracking issue: Update to go1.11.5 and 1.10.8 #73238

cblecker opened this issue Jan 24, 2019 · 11 comments
Labels
area/security priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. sig/release Categorizes an issue or PR as relevant to SIG Release.

Comments

@cblecker
Copy link
Member

cblecker commented Jan 24, 2019 •
edited

The go team has released go1.11.5 and 1.10.8 with a security fix.
https://groups.google.com/d/msg/golang-announce/mVeX35iXuSw/Flp8FX7QEAAJ

We have just released Go 1.11.5 and Go 1.10.8 to address a recently reported security issue. We recommend that all users update to one of these releases (if you’re not sure which, choose Go 1.11.5).

This DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU.

These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some cases, if an ECDH private key is reused more than once, the attack can also lead to key recovery.

The issue is CVE-2019-6486 and Go issue golang/go#29903. See the Go issue for more details.

We should kick off upgrades of both the kubernetes build system, and our CI, as soon as possible.

Status:

cc: @ixdy @kubernetes/sig-testing @kubernetes/sig-release @kubernetes/product-security-team
/area security
/sig release
/priority critical-urgent
@k8s-ci-robot k8s-ci-robot added area/security sig/release Categorizes an issue or PR as relevant to SIG Release. priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. labels Jan 24, 2019
@cjcullen
Copy link
Member

Patch Managers:
1.11: @foxish
1.12: @feiskyer
1.13: @aleksandra-malinowska, @tpepper

@BenTheElder
Copy link
Member

related: https://github.com/kubernetes/kubernetes/issues/73286

@foxish
Copy link
Contributor

foxish commented Jan 24, 2019

sgtm - this will miss 1.11.7 (because that's slated to go out today), but we can get a 1.11.8 sometime soon with these fixes.

mvladev pushed a commit to mvladev/gardener that referenced this issue Jan 25, 2019
Upgrade golang version to 1.11.5
51b6260 
Fixes golang/go#29903
Relate K8S issue kubernetes/kubernetes#73238
mvladev pushed a commit to mvladev/gardener that referenced this issue Jan 25, 2019
Upgrade golang version to 1.11.5
cb66e2f 
golang issue golang/go#29903
K8S issue kubernetes/kubernetes#73238
@mvladev mvladev mentioned this issue Jan 25, 2019
Merged
mvladev pushed a commit to gardener-attic/gardener-extensions that referenced this issue Jan 25, 2019
Update golang version to 1.11.5
98e8705 
**What this PR does / why we need it**:

> We have just released Go 1.11.5 and Go 1.10.8 to address a recently reported security issue. We recommend that all users update to one of these releases (if you’re not sure which, choose Go 1.11.5).
>
> This DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU.
>
> These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some cases, if an ECDH private key is reused more than once, the attack can also lead to key recovery.
>
> The issue is CVE-2019-6486 and Go issue golang/go#29903. See the Go issue for more details.

K8S issue kubernetes/kubernetes#73238

**Which issue(s) this PR fixes**:
n/a

**Special notes for your reviewer**:

**Release note**:
<!--  Write your release note:
1. Enter your release note in the below block.
2. If no release note is required, just write "NONE" within the block.

Format of block header: <category> <target_group>
Possible values:
- category:       improvement|noteworthy|action
- target_group:   user|operator
-->
```improvement operator
NONE
```

/cc @ThormaehlenFred
@mvladev mvladev mentioned this issue Jan 25, 2019
Closed
This was referenced Jan 25, 2019
Merged
Merged
Merged
This was referenced Jan 27, 2019
Merged
Merged
@cblecker
Copy link
Member Author

@foxish Looks like the only branch we are still waiting to merge is 1.11 (#73379)

@foxish
Copy link
Contributor

foxish commented Jan 31, 2019

Just approved the cherrypick @cblecker. Thanks!

@cblecker
Copy link
Member Author

Looks like all the updates have merged. Closing this out. Thank you everyone!
/close

@k8s-ci-robot
Copy link
Contributor

@cblecker: Closing this issue.

In response to this:

Looks like all the updates have merged. Closing this out. Thank you everyone!
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tpepper
Copy link
Member

tpepper commented Feb 2, 2019

FTR 1.13.3 cut today w/ this included.

https://github.com/kubernetes/kubernetes/releases/tag/v1.13.3

@tabern tabern mentioned this issue Feb 22, 2019
Closed
@tuminoid
Copy link

1.12 release with this fix is not out yet? 1.12.5 updates go to 1.10.7, and was cut Jan 16th (based on release note), but this fix was merged 25th.

@feiskyer
Copy link
Member

1.12 release with this fix is not out yet? 1.12.5 updates go to 1.10.7, and was cut Jan 16th (based on release note), but this fix was merged 25th.

Not yet, would be included in v1.12.6 (planned this week).

@ixdy
Copy link
Member

ixdy commented Feb 25, 2019

It also looks like there has not yet been a 1.11 release with this fix.

richardyuwen pushed a commit to richardyuwen/gardener that referenced this issue Mar 26, 2019
Upgrade golang version to 1.11.5
8a35b59 
golang issue golang/go#29903
K8S issue kubernetes/kubernetes#73238
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/security priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. sig/release Categorizes an issue or PR as relevant to SIG Release.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
9 participants
@feiskyer @tuminoid @foxish @BenTheElder @cblecker @tpepper @cjcullen @ixdy @k8s-ci-robot