Skip to content

Commit 423693d

Browse files
thaJeztahthaJeztah
committed
[release/1.7] update to go1.20.8
go1.20.8 (released 2023-09-06) includes two security fixes to the html/template package, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/tls, go/types, net/http, and path/filepath packages. See the Go 1.20.8 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.20.8+label%3ACherryPickApproved full diff: golang/go@go1.20.7...go1.20.8 From the security mailing: [security] Go 1.21.1 and Go 1.20.8 are released Hello gophers, We have just released Go versions 1.21.1 and 1.20.8, minor point releases. These minor releases include 4 security fixes following the security policy: - cmd/go: go.mod toolchain directive allows arbitrary execution The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software. Thanks to Juho Nurminen of Mattermost for reporting this issue. This is CVE-2023-39320 and Go issue https://go.dev/issue/62198. - html/template: improper handling of HTML-like comments within script contexts The html/template package did not properly handle HMTL-like "<!--" and "-->" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39318 and Go issue https://go.dev/issue/62196. - html/template: improper handling of special tags within script contexts The html/template package did not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39319 and Go issue https://go.dev/issue/62197. - crypto/tls: panic when processing post-handshake message on QUIC connections Processing an incomplete post-handshake message for a QUIC connection caused a panic. Thanks to Marten Seemann for reporting this issue. This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266. Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent 7791d75 commit 423693d

9 files changed

Lines changed: 10 additions & 10 deletions

File tree

‎.github/workflows/build-test-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
steps:
4444
- uses: actions/setup-go@v3
4545
with:
46-
go-version: "1.20.7"
46+
go-version: "1.20.8"
4747

4848
- uses: actions/checkout@v3
4949
with:

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ on:
1212
env:
1313
# Go version we currently use to build containerd across all CI.
1414
# Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
15-
GO_VERSION: "1.20.7"
15+
GO_VERSION: "1.20.8"
1616

1717
permissions: # added using https://github.com/step-security/secure-workflows
1818
contents: read
@@ -207,7 +207,7 @@ jobs:
207207
strategy:
208208
matrix:
209209
os: [ubuntu-20.04, macos-12, windows-2019, windows-2022]
210-
go-version: ["1.20.7", "1.19.12"]
210+
go-version: ["1.20.8", "1.19.12"]
211211
steps:
212212
- uses: actions/setup-go@v3
213213
with:

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434

3535
- uses: actions/setup-go@v3
3636
with:
37-
go-version: 1.20.7
37+
go-version: 1.20.8
3838

3939
# Initializes the CodeQL tools for scanning.
4040
- name: Initialize CodeQL

‎.github/workflows/images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
steps:
2929
- uses: actions/setup-go@v3
3030
with:
31-
go-version: "1.20.7"
31+
go-version: "1.20.8"
3232

3333
- uses: actions/checkout@v3
3434
with:

‎.github/workflows/nightly.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
- ".github/workflows/nightly.yml"
88

99
env:
10-
GO_VERSION: "1.20.7"
10+
GO_VERSION: "1.20.8"
1111

1212
permissions: # added using https://github.com/step-security/secure-workflows
1313
contents: read

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ on:
1313
name: Release
1414

1515
env:
16-
GO_VERSION: "1.20.7"
16+
GO_VERSION: "1.20.8"
1717

1818
permissions: # added using https://github.com/step-security/secure-workflows
1919
contents: read

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ EOF
102102
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
103103
sh.upload_path = "/tmp/vagrant-install-golang"
104104
sh.env = {
105-
'GO_VERSION': ENV['GO_VERSION'] || "1.20.7",
105+
'GO_VERSION': ENV['GO_VERSION'] || "1.20.8",
106106
}
107107
sh.inline = <<~SHELL
108108
#!/usr/bin/env bash

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
# docker run --privileged containerd-test
3030
# ------------------------------------------------------------------------------
3131

32-
ARG GOLANG_VERSION=1.20.7
32+
ARG GOLANG_VERSION=1.20.8
3333
ARG GOLANG_IMAGE=golang
3434

3535
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

‎script/setup/prepare_env_windows.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# lived test environment.
66
Set-MpPreference -DisableRealtimeMonitoring:$true
77

8-
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.7"; make = ""; nssm = "" }
8+
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.8"; make = ""; nssm = "" }
99

1010
Write-Host "Downloading chocolatey package"
1111
curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

0 commit comments

Comments
 (0)