Skip to content

Commit b947a6f

Browse files
thaJeztahthaJeztah
committed
update go to go1.20.4, go1.19.9
go1.20.4 (released 2023-05-02) includes three security fixes to the html/template package, as well as bug fixes to the compiler, the runtime, and the crypto/subtle, crypto/tls, net/http, and syscall packages. See the Go 1.20.4 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.20.4+label%3ACherryPickApproved release notes: https://go.dev/doc/devel/release#go1.20.4 full diff: golang/go@go1.20.3...go1.20.4 from the announcement: > These minor releases include 3 security fixes following the security policy: > > - html/template: improper sanitization of CSS values > > Angle brackets (`<>`) were not considered dangerous characters when inserted > into CSS contexts. Templates containing multiple actions separated by a '/' > character could result in unexpectedly closing the CSS context and allowing > for injection of unexpected HMTL, if executed with untrusted input. > > Thanks to Juho Nurminen of Mattermost for reporting this issue. > > This is CVE-2023-24539 and Go issue https://go.dev/issue/59720. > > - html/template: improper handling of JavaScript whitespace > > Not all valid JavaScript whitespace characters were considered to be > whitespace. Templates containing whitespace characters outside of the character > set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain > actions may not be properly sanitized during execution. > > Thanks to Juho Nurminen of Mattermost for reporting this issue. > > This is CVE-2023-24540 and Go issue https://go.dev/issue/59721. > > - html/template: improper handling of empty HTML attributes > > Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") > executed with empty input could result in output that would have unexpected > results when parsed due to HTML normalization rules. This may allow injection > of arbitrary attributes into tags. > > Thanks to Juho Nurminen of Mattermost for reporting this issue. > > This is CVE-2023-29400 and Go issue https://go.dev/issue/59722. Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent bed2bef commit b947a6f

9 files changed

Lines changed: 10 additions & 10 deletions

File tree

‎.github/workflows/build-test-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
steps:
4444
- uses: actions/setup-go@v3
4545
with:
46-
go-version: "1.20.3"
46+
go-version: "1.20.4"
4747

4848
- uses: actions/checkout@v3
4949
with:

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ on:
1515
env:
1616
# Go version we currently use to build containerd across all CI.
1717
# Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
18-
GO_VERSION: "1.20.3"
18+
GO_VERSION: "1.20.4"
1919

2020
permissions: # added using https://github.com/step-security/secure-workflows
2121
contents: read
@@ -210,7 +210,7 @@ jobs:
210210
strategy:
211211
matrix:
212212
os: [ubuntu-20.04, macos-12, windows-2019, windows-2022]
213-
go-version: ["1.20.3", "1.19.8"]
213+
go-version: ["1.20.4", "1.19.9"]
214214
steps:
215215
- uses: actions/setup-go@v4
216216
with:

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434

3535
- uses: actions/setup-go@v3
3636
with:
37-
go-version: 1.20.3
37+
go-version: 1.20.4
3838

3939
# Initializes the CodeQL tools for scanning.
4040
- name: Initialize CodeQL

‎.github/workflows/images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
steps:
2929
- uses: actions/setup-go@v3
3030
with:
31-
go-version: "1.20.3"
31+
go-version: "1.20.4"
3232

3333
- uses: actions/checkout@v3
3434
with:

‎.github/workflows/nightly.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
- ".github/workflows/nightly.yml"
88

99
env:
10-
GO_VERSION: "1.20.3"
10+
GO_VERSION: "1.20.4"
1111

1212
permissions: # added using https://github.com/step-security/secure-workflows
1313
contents: read

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ on:
1313
name: Release
1414

1515
env:
16-
GO_VERSION: "1.20.3"
16+
GO_VERSION: "1.20.4"
1717

1818
permissions: # added using https://github.com/step-security/secure-workflows
1919
contents: read

‎Vagrantfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ EOF
101101
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
102102
sh.upload_path = "/tmp/vagrant-install-golang"
103103
sh.env = {
104-
'GO_VERSION': ENV['GO_VERSION'] || "1.20.3",
104+
'GO_VERSION': ENV['GO_VERSION'] || "1.20.4",
105105
}
106106
sh.inline = <<~SHELL
107107
#!/usr/bin/env bash

‎contrib/Dockerfile.test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
# docker run --privileged containerd-test
3030
# ------------------------------------------------------------------------------
3131

32-
ARG GOLANG_VERSION=1.20.3
32+
ARG GOLANG_VERSION=1.20.4
3333
ARG GOLANG_IMAGE=golang
3434

3535
FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang

‎script/setup/prepare_env_windows.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# lived test environment.
66
Set-MpPreference -DisableRealtimeMonitoring:$true
77

8-
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.3"; make = ""; nssm = "" }
8+
$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.4"; make = ""; nssm = "" }
99

1010
Write-Host "Downloading chocolatey package"
1111
curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'

0 commit comments

Comments
 (0)