Skip to content

Commit 28324c5

Browse files
thaJeztahthaJeztah
committed
[release/1.6] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715
From the mailing list: We have just released Go versions 1.19.2 and 1.18.7, minor point releases. These minor releases include 3 security fixes following the security policy: - archive/tar: unbounded memory consumption when reading headers Reader.Read did not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. Reader.Read now limits the maximum size of header blocks to 1 MiB. Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting this issue. This is CVE-2022-2879 and Go issue https://go.dev/issue/54853. - net/http/httputil: ReverseProxy should not forward unparseable query parameters Requests forwarded by ReverseProxy included the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. ReverseProxy will now sanitize the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy.Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged. Thanks to Gal Goldstein (Security Researcher, Oxeye) and Daniel Abeles (Head of Research, Oxeye) for reporting this issue. This is CVE-2022-2880 and Go issue https://go.dev/issue/54663. - regexp/syntax: limit memory used by parsing regexps The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. Each regexp being parsed is now limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are now rejected. Normal use of regular expressions is unaffected. Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting this issue. This is CVE-2022-41715 and Go issue https://go.dev/issue/55949. View the release notes for more information: https://go.dev/doc/devel/release#go1.18.7 Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent 0aeeb62 commit 28324c5

9 files changed

Lines changed: 18 additions & 18 deletions

File tree

‎.github/workflows/build-test-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
steps:
4040
- uses: actions/setup-go@v2
4141
with:
42-
go-version: '1.17.13'
42+
go-version: '1.18.7'
4343

4444
- uses: actions/checkout@v2
4545
with:

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020

2121
strategy:
2222
matrix:
23-
go-version: [1.17.13]
23+
go-version: [1.18.7]
2424
os: [ubuntu-18.04, macos-12, windows-2019]
2525

2626
steps:
@@ -46,7 +46,7 @@ jobs:
4646
steps:
4747
- uses: actions/setup-go@v2
4848
with:
49-
go-version: '1.17.13'
49+
go-version: '1.18.7'
5050

5151
- uses: actions/checkout@v2
5252
with:
@@ -78,7 +78,7 @@ jobs:
7878
steps:
7979
- uses: actions/setup-go@v2
8080
with:
81-
go-version: '1.17.13'
81+
go-version: '1.18.7'
8282

8383
- uses: actions/checkout@v2
8484
with:
@@ -110,7 +110,7 @@ jobs:
110110
steps:
111111
- uses: actions/setup-go@v2
112112
with:
113-
go-version: '1.17.13'
113+
go-version: '1.18.7'
114114
- uses: actions/checkout@v2
115115
- run: go install github.com/cpuguy83/go-md2man/[email protected]
116116
- run: make man
@@ -148,7 +148,7 @@ jobs:
148148
steps:
149149
- uses: actions/setup-go@v2
150150
with:
151-
go-version: '1.17.13'
151+
go-version: '1.18.7'
152152
- uses: actions/checkout@v2
153153
- run: |
154154
set -e -x
@@ -215,7 +215,7 @@ jobs:
215215
strategy:
216216
matrix:
217217
os: [ubuntu-18.04, macos-12, windows-2019, windows-2022]
218-
go-version: ['1.16.15', '1.17.13']
218+
go-version: ['1.17.13', '1.18.7']
219219

220220
steps:
221221
- uses: actions/setup-go@v2
@@ -262,7 +262,7 @@ jobs:
262262
steps:
263263
- uses: actions/setup-go@v2
264264
with:
265-
go-version: '1.17.13'
265+
go-version: '1.18.7'
266266

267267
- uses: actions/checkout@v2
268268
with:
@@ -352,7 +352,7 @@ jobs:
352352
steps:
353353
- uses: actions/setup-go@v2
354354
with:
355-
go-version: '1.17.13'
355+
go-version: '1.18.7'
356356

357357
- uses: actions/checkout@v2
358358

@@ -475,7 +475,7 @@ jobs:
475475
steps:
476476
- uses: actions/setup-go@v2
477477
with:
478-
go-version: '1.17.13'
478+
go-version: '1.18.7'
479479
- uses: actions/checkout@v2
480480
- run: sudo -E PATH=$PATH script/setup/install-gotestsum
481481
- name: Tests

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626

2727
- uses: actions/setup-go@v2
2828
with:
29-
go-version: 1.17.13
29+
go-version: 1.18.7
3030

3131
# Initializes the CodeQL tools for scanning.
3232
- name: Initialize CodeQL

‎.github/workflows/images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
steps:
2525
- uses: actions/setup-go@v2
2626
with:
27-
go-version: '1.17.13'
27+
go-version: '1.18.7'
2828

2929
- uses: actions/checkout@v2
3030
with:

‎.github/workflows/nightly.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
steps:
1919
- uses: actions/setup-go@v2
2020
with:
21-
go-version: '1.17.13'
21+
go-version: '1.18.7'
2222

2323
- uses: actions/checkout@v2
2424
with:
@@ -155,7 +155,7 @@ jobs:
155155
steps:
156156
- uses: actions/setup-go@v2
157157
with:
158-
go-version: '1.17.13'
158+
go-version: '1.18.7'
159159

160160
- uses: actions/checkout@v2
161161
with:

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ jobs:
111111
find ./releases/ -maxdepth 1 -type l | xargs rm
112112
working-directory: src/github.com/containerd/containerd
113113
env:
114-
GO_VERSION: '1.17.13'
114+
GO_VERSION: '1.18.7'
115115
PLATFORM: ${{ matrix.platform }}
116116
- name: Save Artifacts
117117
uses: actions/upload-artifact@v2

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ EOF
9191
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
9292
sh.upload_path = "/tmp/vagrant-install-golang"
9393
sh.env = {
94-
'GO_VERSION': ENV['GO_VERSION'] || "1.17.13",
94+
'GO_VERSION': ENV['GO_VERSION'] || "1.18.7",
9595
}
9696
sh.inline = <<~SHELL
9797
#!/usr/bin/env bash

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#
1111
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
1212

13-
ARG GOLANG_VERSION=1.17.13
13+
ARG GOLANG_VERSION=1.18.7
1414
ARG GOLANG_IMAGE=golang
1515

1616
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

‎script/setup/prepare_env_windows.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Prepare windows environment for building and running containerd tests
22

3-
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.17.13"; make = ""; nssm = "" }
3+
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.18.7"; make = ""; nssm = "" }
44

55
Write-Host "Downloading chocolatey package"
66
curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

0 commit comments

Comments
 (0)