Skip to content

Commit b4240ef

Browse files
thaJeztahestesp
thaJeztah
authored and
estesp
committed
update to go1.24.13, go1.25.7
go1.25.7 (released 2026-02-04) includes security fixes to the go command and the crypto/tls package, as well as bug fixes to the compiler and the crypto/x509 package. See the Go 1.25.7 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.25.7+label%3ACherryPickApproved full diff: golang/go@go1.25.6...go1.25.7 From the security mailing list: > Hello gophers, > > We have just released Go versions 1.25.7 and 1.24.13, minor point releases. > > These releases include 2 security fixes following the security policy: > > - cmd/cgo: remove user-content from doc strings in cgo ASTs > > A discrepancy between how Go and C/C++ comments > were parsed allowed for code smuggling into the > resulting cgo binary. > > To prevent this behavior, the cgo compiler > will no longer parse user-provided doc > comments. > > Thank you to RyotaK (https://ryotak.net) of > GMO Flatt Security Inc. for reporting this issue. > > This is CVE-2025-61732 and https://go.dev/issue/76697. > > - crypto/tls: unexpected session resumption when using Config.GetConfigForClient > > Config.GetConfigForClient is documented to use the original Config's session > ticket keys unless explicitly overridden. This can cause unexpected behavior if > the returned Config modifies authentication parameters, like ClientCAs: a > connection initially established with the parent (or a sibling) Config can be > resumed, bypassing the modified authentication requirements. > > If ClientAuth is VerifyClientCertIfGiven or RequireAndVerifyClientCert (on the > server) or InsecureSkipVerify is false (on the client), crypto/tls now checks > that the root of the previously-verified chain is still in ClientCAs/RootCAs > when resuming a connection. > > Go 1.26 Release Candidate 2, Go 1.25.6, and Go 1.24.12 had fixed a similar issue > related to session ticket keys being implicitly shared by Config.Clone. Since > this fix is broader, the Config.Clone behavior change has been reverted. > > Note that VerifyPeerCertificate still behaves as documented: it does not apply > to resumed connections. Applications that use Config.GetConfigForClient or > Config.Clone and do not wish to blindly resume connections established with the > original Config must use VerifyConnection instead (or SetSessionTicketKeys or > SessionTicketsDisabled). > > Thanks to Coia Prant (github.com/rbqvq) for reporting this issue. > > This updates CVE-2025-68121 and Go issue https://go.dev/issue/77217. Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 1551986) Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent 94dbfae commit b4240ef

9 files changed

Lines changed: 10 additions & 10 deletions

File tree

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"features": {
1313
"ghcr.io/devcontainers/features/docker-in-docker:2": {},
1414
"ghcr.io/devcontainers/features/go:1": {
15-
"version": "1.24.12"
15+
"version": "1.24.13"
1616
}
1717
},
1818

‎.github/actions/install-go/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: "Reusable action to install Go, so there is one place to bump Go ve
33
inputs:
44
go-version:
55
required: true
6-
default: "1.24.12"
6+
default: "1.24.13"
77
description: "Go version to install"
88

99
runs:

‎.github/workflows/api-release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
name: API Release
77

88
env:
9-
GO_VERSION: "1.24.12"
9+
GO_VERSION: "1.24.13"
1010

1111
permissions: # added using https://github.com/step-security/secure-workflows
1212
contents: read

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ jobs:
195195
strategy:
196196
matrix:
197197
os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
198-
go-version: ["1.24.12", "1.25.6"]
198+
go-version: ["1.24.13", "1.25.7"]
199199
exclude:
200200
- os: ${{ github.event.repository.private && 'ubuntu-24.04-arm' || '' }}
201201
steps:

‎.github/workflows/release/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
ARG UBUNTU_VERSION=22.04
1616
ARG BASE_IMAGE=ubuntu:${UBUNTU_VERSION}
17-
ARG GO_VERSION=1.24.12
17+
ARG GO_VERSION=1.24.13
1818
ARG GO_IMAGE=golang:${GO_VERSION}
1919
FROM --platform=$BUILDPLATFORM $GO_IMAGE AS go
2020
FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ EOF
107107
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
108108
sh.upload_path = "/tmp/vagrant-install-golang"
109109
sh.env = {
110-
'GO_VERSION': ENV['GO_VERSION'] || "1.24.12",
110+
'GO_VERSION': ENV['GO_VERSION'] || "1.24.13",
111111
}
112112
sh.inline = <<~SHELL
113113
#!/usr/bin/env bash

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
# docker run --privileged --group-add keep-groups -v ./critest_exit_code.txt:/tmp/critest_exit_code.txt containerd-test
3535
# ------------------------------------------------------------------------------
3636

37-
ARG GOLANG_VERSION=1.24.12
37+
ARG GOLANG_VERSION=1.24.13
3838
ARG GOLANG_IMAGE=golang
3939

4040
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

‎contrib/fuzz/oss_fuzz_build.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ compile_fuzzers() {
3939

4040
apt-get update && apt-get install -y wget
4141
cd $SRC
42-
wget --quiet https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
42+
wget --quiet https://go.dev/dl/go1.24.13.linux-amd64.tar.gz
4343

4444
mkdir temp-go
4545
rm -rf /root/.go/*
46-
tar -C temp-go/ -xzf go1.24.12.linux-amd64.tar.gz
46+
tar -C temp-go/ -xzf go1.24.13.linux-amd64.tar.gz
4747
mv temp-go/go/* /root/.go/
4848
cd $SRC/containerd
4949

‎script/setup/prepare_env_windows.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# lived test environment.
66
Set-MpPreference -DisableRealtimeMonitoring:$true
77

8-
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.24.12"; make = ""; nssm = "" }
8+
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.24.13"; make = ""; nssm = "" }
99

1010
Write-Host "Downloading chocolatey package"
1111
curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

0 commit comments

Comments
 (0)