update to go1.19.4 #3907
Merged
update to go1.19.4 #3907
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Includes security fixes for net/http (CVE-2022-41717, CVE-2022-41720), and os (CVE-2022-41720). These minor releases include 2 security fixes following the security policy: - os, net/http: avoid escapes from os.DirFS and http.Dir on Windows The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permitted access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") would open the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory \(the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. The behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error. This is CVE-2022-41720 and Go issue https://go.dev/issue/56694. - net/http: limit canonical header cache by bytes, not entries An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. This issue is also fixed in golang.org/x/net/http2 vX.Y.Z, for users manually configuring HTTP/2. Thanks to Josselin Costanzi for reporting this issue. This is CVE-2022-41717 and Go issue https://go.dev/issue/56350. View the release notes for more information: https://go.dev/doc/devel/release#go1.19.4 And the milestone on the issue tracker: https://github.com/golang/go/issues?q=milestone%3AGo1.19.4+label%3ACherryPickApproved Full diff: golang/go@go1.19.3...go1.19.4 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Codecov Report
Additional details and impacted files@@ Coverage Diff @@
## master #3907 +/- ##
=======================================
Coverage 59.23% 59.23%
=======================================
Files 287 287
Lines 24731 24731
=======================================
Hits 14649 14649
Misses 9197 9197
Partials 885 885 |
sam-thibault
approved these changes
Dec 7, 2022
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this pull request
May 11, 2023
CI - Dockerfile: fix filenames of artifacts Bugfixes - Fix panic in inmemory driver - Add code to handle pagination of parts. Fixes max layer size of 10GB bug - Parse http forbidden as denied - Revert "registry/client: set Accept: identity header when getting layers Runtime - Update to go1.19.9 - Dockerfile: update xx to v1.2.1 ([docker#3907](distribution/distribution#3907)) Security - Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 - Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](distribution/distribution@521ea3d) full diff: distribution/distribution@v2.8.1...v2.8.2-beta.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this pull request
May 11, 2023
CI - Dockerfile: fix filenames of artifacts Bugfixes - Fix panic in inmemory driver - Add code to handle pagination of parts. Fixes max layer size of 10GB bug - Parse http forbidden as denied - Revert "registry/client: set Accept: identity header when getting layers Runtime - Update to go1.19.9 - Dockerfile: update xx to v1.2.1 ([docker#3907](distribution/distribution#3907)) Security - Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 - Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](distribution/distribution@521ea3d) full diff: distribution/distribution@v2.8.1...v2.8.2-beta.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 353e0a9) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this pull request
May 11, 2023
CI - Dockerfile: fix filenames of artifacts Bugfixes - Fix panic in inmemory driver - Add code to handle pagination of parts. Fixes max layer size of 10GB bug - Parse http forbidden as denied - Revert "registry/client: set Accept: identity header when getting layers Runtime - Update to go1.19.9 - Dockerfile: update xx to v1.2.1 ([docker#3907](distribution/distribution#3907)) Security - Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 - Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](distribution/distribution@521ea3d) full diff: distribution/distribution@v2.8.1...v2.8.2-beta.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 353e0a9) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
frikke
pushed a commit
to frikke/cli-2
that referenced
this pull request
Jun 15, 2023
CI - Dockerfile: fix filenames of artifacts Bugfixes - Fix panic in inmemory driver - Add code to handle pagination of parts. Fixes max layer size of 10GB bug - Parse http forbidden as denied - Revert "registry/client: set Accept: identity header when getting layers Runtime - Update to go1.19.9 - Dockerfile: update xx to v1.2.1 ([docker#3907](distribution/distribution#3907)) Security - Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 - Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](distribution/distribution@521ea3d) full diff: distribution/distribution@v2.8.1...v2.8.2-beta.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this pull request
Jul 17, 2023
CI - Dockerfile: fix filenames of artifacts Bugfixes - Fix panic in inmemory driver - Add code to handle pagination of parts. Fixes max layer size of 10GB bug - Parse http forbidden as denied - Revert "registry/client: set Accept: identity header when getting layers Runtime - Update to go1.19.9 - Dockerfile: update xx to v1.2.1 ([docker#3907](distribution/distribution#3907)) Security - Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 - Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](distribution/distribution@521ea3d) full diff: distribution/distribution@v2.8.1...v2.8.2-beta.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 353e0a9) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
thaJeztah
added a commit
to thaJeztah/cli
that referenced
this pull request
Jul 17, 2023
CI - Dockerfile: fix filenames of artifacts Bugfixes - Fix panic in inmemory driver - Add code to handle pagination of parts. Fixes max layer size of 10GB bug - Parse http forbidden as denied - Revert "registry/client: set Accept: identity header when getting layers Runtime - Update to go1.19.9 - Dockerfile: update xx to v1.2.1 ([docker#3907](distribution/distribution#3907)) Security - Fix [CVE-2022-28391](https://www.cve.org/CVERecord?id=CVE-2022-28391) by bumping alpine from 3.14 to 3.16 - Fix [CVE-2023-2253](https://www.cve.org/CVERecord?id=CVE-2023-2253) runaway allocation on /v2/_catalog [`521ea3d9`](distribution/distribution@521ea3d) full diff: distribution/distribution@v2.8.1...v2.8.2-beta.2 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 353e0a9) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Includes security fixes for net/http (CVE-2022-41717, CVE-2022-41720), and os (CVE-2022-41720).
These minor releases include 2 security fixes following the security policy:
os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permitted access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") would open the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access.
In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system.
The behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error.
This is CVE-2022-41720 and Go issue https://go.dev/issue/56694.
net/http: limit canonical header cache by bytes, not entries
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.
HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
This issue is also fixed in golang.org/x/net/http2 vX.Y.Z, for users manually configuring HTTP/2.
Thanks to Josselin Costanzi for reporting this issue.
This is CVE-2022-41717 and Go issue https://go.dev/issue/56350.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.19.4
And the milestone on the issue tracker:
https://github.com/golang/go/issues?q=milestone%3AGo1.19.4+label%3ACherryPickApproved
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)