From d2639a86383bd8ab7102867d1d9140a101106180 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 2 Jun 2022 09:56:16 +0200 Subject: [PATCH] update golang to 1.18.3 go1.18.3 (released 2022-06-01) includes security fixes to the crypto/rand, crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the compiler, and the crypto/tls and text/template/parse packages. See the Go 1.18.3 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.18.3+label%3ACherryPickApproved Hello gophers, We have just released Go versions 1.18.3 and 1.17.11, minor point releases. These minor releases include 4 security fixes following the security policy: - crypto/rand: rand.Read hangs with extremely large buffers On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 << 32 - 1 bytes. Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset, for reporting this issue. This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561. - crypto/tls: session tickets lack random ticket_age_add Session tickets generated by crypto/tls did not contain a randomly generated ticket_age_add. This allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. Thanks to GitHub user nervuri for reporting this. This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814. - `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput` are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed. Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting this. This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574. - `path/filepath`: Clean(`.\c:`) returns `c:` on Windows On Windows, the `filepath.Clean` function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. Thanks to Unrud for reporting this issue. This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476. [CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634 [CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629 [CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580 [CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/artifacts.yml | 2 +- .github/workflows/ci.yml | 8 ++++---- .github/workflows/release.yaml | 2 +- Dockerfile | 2 +- docs/docs.Dockerfile | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/artifacts.yml b/.github/workflows/artifacts.yml index 7675a14d..f5e0db45 100644 --- a/.github/workflows/artifacts.yml +++ b/.github/workflows/artifacts.yml @@ -10,7 +10,7 @@ jobs: - name: Set up Go 1.18 uses: actions/setup-go@v2 with: - go-version: 1.18.2 + go-version: 1.18.3 id: go - name: Checkout code into the Go module directory diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 79abd48c..d0b8af50 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: - name: Set up Go 1.18 uses: actions/setup-go@v2 with: - go-version: 1.18.2 + go-version: 1.18.3 id: go - name: Checkout code into the Go module directory @@ -49,7 +49,7 @@ jobs: - name: Set up Go 1.18 uses: actions/setup-go@v2 with: - go-version: 1.18.2 + go-version: 1.18.3 id: go - name: Checkout code into the Go module directory @@ -74,7 +74,7 @@ jobs: - name: Set up Go 1.18 uses: actions/setup-go@v2 with: - go-version: 1.18.2 + go-version: 1.18.3 id: go - name: Setup docker CLI @@ -110,7 +110,7 @@ jobs: - name: Set up Go 1.18 uses: actions/setup-go@v2 with: - go-version: 1.18.2 + go-version: 1.18.3 id: go - name: Setup docker CLI diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index ed3ae129..74805b21 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -14,7 +14,7 @@ jobs: - name: Set up Go 1.18 uses: actions/setup-go@v2 with: - go-version: 1.18.2 + go-version: 1.18.3 id: go - name: Setup docker CLI diff --git a/Dockerfile b/Dockerfile index 1608365a..6a9747cd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG GO_VERSION=1.18.2-alpine +ARG GO_VERSION=1.18.3-alpine ARG GOLANGCI_LINT_VERSION=v1.40.1-alpine ARG PROTOC_GEN_GO_VERSION=v1.4.3 diff --git a/docs/docs.Dockerfile b/docs/docs.Dockerfile index 867b7ce9..61657b7e 100644 --- a/docs/docs.Dockerfile +++ b/docs/docs.Dockerfile @@ -15,7 +15,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -ARG GO_VERSION=1.18.2 +ARG GO_VERSION=1.18.3 ARG FORMATS=md,yaml FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION}-alpine AS docsgen