From ae0fda655b01eb96614acff1dfeeb1859df22802 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Mon, 20 Jan 2025 15:46:12 +0100 Subject: [PATCH] update to go1.23.5 (fix CVE-2024-45341, CVE-2024-45336) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit go1.23.5 (released 2025-01-16) includes security fixes to the crypto/x509 and net/http packages, as well as bug fixes to the compiler, the runtime, and the net package. See the Go 1.23.5 milestone on our issue tracker for details; - https://github.com/golang/go/issues?q=milestone%3AGo1.23.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.23.4...go1.23.5 Hello gophers, We have just released Go versions 1.23.5 and 1.22.11, minor point releases. These minor releases include 2 security fixes following the security policy: - crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs. Thanks to Juho Forsén of Mattermost for reporting this issue. This is CVE-2024-45341 and Go issue https://go.dev/issue/71156. - net/http: sensitive headers incorrectly sent after cross-domain redirect The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2. Thanks to Kyle Seely for reporting this issue. This is CVE-2024-45336 and Go issue https://go.dev/issue/70530. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/.test.yml | 2 +- .github/workflows/.windows.yml | 2 +- .github/workflows/arm64.yml | 2 +- .github/workflows/buildkit.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/test.yml | 2 +- .golangci.yml | 2 +- Dockerfile | 2 +- Dockerfile.simple | 2 +- Dockerfile.windows | 2 +- hack/dockerfiles/generate-files.Dockerfile | 2 +- hack/dockerfiles/govulncheck.Dockerfile | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml index 5b07cee3ca..2203ab7530 100644 --- a/.github/workflows/.test.yml +++ b/.github/workflows/.test.yml @@ -21,7 +21,7 @@ on: default: "graphdriver" env: - GO_VERSION: "1.23.4" + GO_VERSION: "1.23.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.25 ITG_CLI_MATRIX_SIZE: 6 diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml index 8d0234b783..2643c7cb1e 100644 --- a/.github/workflows/.windows.yml +++ b/.github/workflows/.windows.yml @@ -28,7 +28,7 @@ on: default: false env: - GO_VERSION: "1.23.4" + GO_VERSION: "1.23.5" GOTESTLIST_VERSION: v0.3.1 TESTSTAT_VERSION: v0.1.25 WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore diff --git a/.github/workflows/arm64.yml b/.github/workflows/arm64.yml index 0f8bfa78e6..d823dc0da4 100644 --- a/.github/workflows/arm64.yml +++ b/.github/workflows/arm64.yml @@ -22,7 +22,7 @@ on: pull_request: env: - GO_VERSION: "1.23.4" + GO_VERSION: "1.23.5" TESTSTAT_VERSION: v0.1.25 DESTDIR: ./build SETUP_BUILDX_VERSION: edge diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml index 18ab176b75..71e1993ce6 100644 --- a/.github/workflows/buildkit.yml +++ b/.github/workflows/buildkit.yml @@ -22,7 +22,7 @@ on: pull_request: env: - GO_VERSION: "1.23.4" + GO_VERSION: "1.23.5" DESTDIR: ./build SETUP_BUILDX_VERSION: edge SETUP_BUILDKIT_IMAGE: moby/buildkit:latest diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 44ac8e3667..f8d212b740 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -57,7 +57,7 @@ jobs: - name: Update Go uses: actions/setup-go@v5 with: - go-version: "1.23.4" + go-version: "1.23.5" - name: Initialize CodeQL uses: github/codeql-action/init@v3 with: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 70dc5366f4..93639b3e68 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -22,7 +22,7 @@ on: pull_request: env: - GO_VERSION: "1.23.4" + GO_VERSION: "1.23.5" GIT_PAGER: "cat" PAGER: "cat" SETUP_BUILDX_VERSION: edge diff --git a/.golangci.yml b/.golangci.yml index ec9005be92..181b4e6a0b 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -23,7 +23,7 @@ linters: run: # prevent golangci-lint from deducting the go version to lint for through go.mod, # which causes it to fallback to go1.17 semantics. - go: "1.23.4" + go: "1.23.5" concurrency: 2 # Only supported with go modules enabled (build flag -mod=vendor only valid when using modules) # modules-download-mode: vendor diff --git a/Dockerfile b/Dockerfile index 2ae019c121..d8bb64cee1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.7 -ARG GO_VERSION=1.23.4 +ARG GO_VERSION=1.23.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" ARG XX_VERSION=1.6.1 diff --git a/Dockerfile.simple b/Dockerfile.simple index 193f0f0a98..76bdcbf999 100644 --- a/Dockerfile.simple +++ b/Dockerfile.simple @@ -5,7 +5,7 @@ # This represents the bare minimum required to build and test Docker. -ARG GO_VERSION=1.23.4 +ARG GO_VERSION=1.23.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}" diff --git a/Dockerfile.windows b/Dockerfile.windows index 4a08153da4..e1a56fd7ba 100644 --- a/Dockerfile.windows +++ b/Dockerfile.windows @@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG} # Use PowerShell as the default shell SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] -ARG GO_VERSION=1.23.4 +ARG GO_VERSION=1.23.5 ARG GOTESTSUM_VERSION=v1.8.2 ARG GOWINRES_VERSION=v0.3.1 ARG CONTAINERD_VERSION=v1.7.25 diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile index f8fb0e7881..f7f5c2d8c2 100644 --- a/hack/dockerfiles/generate-files.Dockerfile +++ b/hack/dockerfiles/generate-files.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.23.4 +ARG GO_VERSION=1.23.5 ARG BASE_DEBIAN_DISTRO="bookworm" ARG PROTOC_VERSION=3.11.4 diff --git a/hack/dockerfiles/govulncheck.Dockerfile b/hack/dockerfiles/govulncheck.Dockerfile index 2fc6add555..22dd325a91 100644 --- a/hack/dockerfiles/govulncheck.Dockerfile +++ b/hack/dockerfiles/govulncheck.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.23.4 +ARG GO_VERSION=1.23.5 ARG GOVULNCHECK_VERSION=v1.1.3 ARG FORMAT=text