Skip to content

Commit 7cbdfc9

Browse files
thaJeztahthaJeztah
committed
update to go1.20.12, test go1.21.5
go1.20.12 (released 2023-12-05) includes security fixes to the go command, and the net/http and path/filepath packages, as well as bug fixes to the compiler and the go command. See the Go 1.20.12 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.20.12+label%3ACherryPickApproved - full diff: golang/go@go1.20.11...go1.20.12 from the security mailing: [security] Go 1.21.5 and Go 1.20.12 are released Hello gophers, We have just released Go versions 1.21.5 and 1.20.12, minor point releases. These minor releases include 3 security fixes following the security policy: - net/http: limit chunked data overhead A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Thanks to Bartek Nowotarski for reporting this issue. This is CVE-2023-39326 and Go issue https://go.dev/issue/64433. - cmd/go: go get may unexpectedly fallback to insecure git Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). Thanks to David Leadbeater for reporting this issue. This is CVE-2023-45285 and Go issue https://go.dev/issue/63845. - path/filepath: retain trailing \ when cleaning paths like \\?\c:\ Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?\, resulting in filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other effects). The previous behavior has been restored. This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028. Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent 024b1cc commit 7cbdfc9

9 files changed

Lines changed: 10 additions & 10 deletions

File tree

‎.github/workflows/build-test-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
steps:
4242
- uses: actions/setup-go@v3
4343
with:
44-
go-version: "1.20.11"
44+
go-version: "1.20.12"
4545

4646
- uses: actions/checkout@v3
4747
with:

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ on:
1212
env:
1313
# Go version we currently use to build containerd across all CI.
1414
# Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
15-
GO_VERSION: "1.20.11"
15+
GO_VERSION: "1.20.12"
1616

1717
permissions: # added using https://github.com/step-security/secure-workflows
1818
contents: read
@@ -233,7 +233,7 @@ jobs:
233233
strategy:
234234
matrix:
235235
os: [ubuntu-20.04, macos-12, windows-2019, windows-2022]
236-
go-version: ["1.20.11", "1.21.4"]
236+
go-version: ["1.20.12", "1.21.5"]
237237
steps:
238238
- name: Install dependencies
239239
if: matrix.os == 'ubuntu-20.04'

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333

3434
- uses: actions/setup-go@v3
3535
with:
36-
go-version: 1.20.11
36+
go-version: 1.20.12
3737

3838
# Initializes the CodeQL tools for scanning.
3939
- name: Initialize CodeQL

‎.github/workflows/images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
steps:
2727
- uses: actions/setup-go@v3
2828
with:
29-
go-version: "1.20.11"
29+
go-version: "1.20.12"
3030

3131
- uses: actions/checkout@v3
3232
with:

‎.github/workflows/nightly.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
- '.github/workflows/nightly.yml'
88

99
env:
10-
GO_VERSION: "1.20.11"
10+
GO_VERSION: "1.20.12"
1111

1212
permissions: # added using https://github.com/step-security/secure-workflows
1313
contents: read

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
name: Containerd Release
77

88
env:
9-
GO_VERSION: "1.20.11"
9+
GO_VERSION: "1.20.12"
1010

1111
permissions: # added using https://github.com/step-security/secure-workflows
1212
contents: read

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ EOF
9595
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
9696
sh.upload_path = "/tmp/vagrant-install-golang"
9797
sh.env = {
98-
'GO_VERSION': ENV['GO_VERSION'] || "1.20.11",
98+
'GO_VERSION': ENV['GO_VERSION'] || "1.20.12",
9999
}
100100
sh.inline = <<~SHELL
101101
#!/usr/bin/env bash

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#
1111
# docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
1212

13-
ARG GOLANG_VERSION=1.20.11
13+
ARG GOLANG_VERSION=1.20.12
1414
ARG GOLANG_IMAGE=golang
1515

1616
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

‎script/setup/prepare_env_windows.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# lived test environment.
66
Set-MpPreference -DisableRealtimeMonitoring:$true
77

8-
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.11"; make = ""; nssm = "" }
8+
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.12"; make = ""; nssm = "" }
99

1010
Write-Host "Downloading chocolatey package"
1111
curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

0 commit comments

Comments
 (0)