Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade go1.21.2 and Go 1.20.9 #47441

Open
hawkingrei opened this issue Oct 8, 2023 · 1 comment
Open

upgrade go1.21.2 and Go 1.20.9 #47441

hawkingrei opened this issue Oct 8, 2023 · 1 comment
Labels
security Everything related with security type/enhancement

Comments

@hawkingrei
Copy link
Member

Enhancement

These minor releases include 1 security fixes following the security policy:

cmd/go: line directives allows arbitrary execution during build

"//line" directives can be used to bypass the restrictions on "//go:cgo_"
directives, allowing blocked linker and compiler flags to be passed during
compliation. This can result in unexpected execution of arbitrary code when
running "go build". The line directive requires the absolute path of the file in
which the directive lives, which makes exploting this issue significantly more
complex.

This is CVE-2023-39323 and Go issue https://go.dev/issue/63211.

but the other is importance, too.

golang/go#62478
golang/go#62505
golang/go#62464
golang/go#62598

@wuhuizuo
Copy link
Contributor

wuhuizuo commented Oct 8, 2023

/label security

@ti-chi-bot ti-chi-bot bot added the security Everything related with security label Oct 8, 2023
ti-chi-bot bot pushed a commit that referenced this issue Oct 12, 2023
yibin87 pushed a commit to yibin87/tidb that referenced this issue Oct 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Everything related with security type/enhancement
Projects
None yet
Development

No branches or pull requests

2 participants