Skip to content

[release/1.6] update to go1.20.8#9073

Merged
AkihiroSuda merged 1 commit intocontainerd:release/1.6from
thaJeztah:1.6_update_golang_1.20.8
Sep 9, 2023
Merged

[release/1.6] update to go1.20.8#9073
AkihiroSuda merged 1 commit intocontainerd:release/1.6from
thaJeztah:1.6_update_golang_1.20.8

Conversation

@thaJeztah
Copy link
Copy Markdown
Member

@thaJeztah thaJeztah commented Sep 8, 2023

go1.20.8 (released 2023-09-06) includes two security fixes to the html/template package, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/tls, go/types, net/http, and path/filepath packages. See the Go 1.20.8 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.8+label%3ACherryPickApproved

full diff: golang/go@go1.20.7...go1.20.8

From the security mailing:

[security] Go 1.21.1 and Go 1.20.8 are released

Hello gophers,

We have just released Go versions 1.21.1 and 1.20.8, minor point releases.

These minor releases include 4 security fixes following the security policy:

  • cmd/go: go.mod toolchain directive allows arbitrary execution The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

    Thanks to Juho Nurminen of Mattermost for reporting this issue.

    This is CVE-2023-39320 and Go issue https://go.dev/issue/62198.

  • html/template: improper handling of HTML-like comments within script contexts The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

    Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue.

    This is CVE-2023-39318 and Go issue https://go.dev/issue/62196.

  • html/template: improper handling of special tags within script contexts The html/template package did not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

    Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue.

    This is CVE-2023-39319 and Go issue https://go.dev/issue/62197.

  • crypto/tls: panic when processing post-handshake message on QUIC connections Processing an incomplete post-handshake message for a QUIC connection caused a panic.

    Thanks to Marten Seemann for reporting this issue.

    This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266.

@thaJeztah
[release/1.6] update to go1.20.8
a2c2948 
go1.20.8 (released 2023-09-06) includes two security fixes to the html/template
package, as well as bug fixes to the compiler, the go command, the runtime,
and the crypto/tls, go/types, net/http, and path/filepath packages. See the
Go 1.20.8 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.8+label%3ACherryPickApproved

full diff: golang/go@go1.20.7...go1.20.8

From the security mailing:

[security] Go 1.21.1 and Go 1.20.8 are released

Hello gophers,

We have just released Go versions 1.21.1 and 1.20.8, minor point releases.

These minor releases include 4 security fixes following the security policy:

- cmd/go: go.mod toolchain directive allows arbitrary execution
  The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to
  execute scripts and binaries relative to the root of the module when the "go"
  command was executed within the module. This applies to modules downloaded using
  the "go" command from the module proxy, as well as modules downloaded directly
  using VCS software.

  Thanks to Juho Nurminen of Mattermost for reporting this issue.

  This is CVE-2023-39320 and Go issue https://go.dev/issue/62198.

- html/template: improper handling of HTML-like comments within script contexts
  The html/template package did not properly handle HMTL-like "<!--" and "-->"
  comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may
  cause the template parser to improperly interpret the contents of <script>
  contexts, causing actions to be improperly escaped. This could be leveraged to
  perform an XSS attack.

  Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this
  issue.

  This is CVE-2023-39318 and Go issue https://go.dev/issue/62196.

- html/template: improper handling of special tags within script contexts
  The html/template package did not apply the proper rules for handling occurrences
  of "<script", "<!--", and "</script" within JS literals in <script> contexts.
  This may cause the template parser to improperly consider script contexts to be
  terminated early, causing actions to be improperly escaped. This could be
  leveraged to perform an XSS attack.

  Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this
  issue.

  This is CVE-2023-39319 and Go issue https://go.dev/issue/62197.

- crypto/tls: panic when processing post-handshake message on QUIC connections
  Processing an incomplete post-handshake message for a QUIC connection caused a panic.

  Thanks to Marten Seemann for reporting this issue.

  This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
fuweid
fuweid approved these changes Sep 9, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@fuweid fuweid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@AkihiroSuda AkihiroSuda merged commit 3c14029 into containerd:release/1.6 Sep 9, 2023
@thaJeztah thaJeztah deleted the 1.6_update_golang_1.20.8 branch September 9, 2023 08:47
This was referenced Sep 12, 2023
Closed
Closed
Merged
aravindhp added a commit to openshift/containerd that referenced this pull request Sep 16, 2023
@aravindhp
Merge tag 'v1.6.24' into release-4.13
6bbc7a6 
containerd 1.6.24

Welcome to the v1.6.24 release of containerd!

The twenty-fourth patch release for containerd 1.6 contains various fixes and updates.

* **CRI: fix leaked shim caused by high IO pressure** ([containerd#9004](containerd#9004))
* **Update to go1.20.8** ([containerd#9073](containerd#9073))
* **Update runc to v1.1.9** ([containerd#8966](containerd#8966))
* **Backport: add configurable mount options to overlay snapshotter** ([containerd#8961](containerd#8961))
* **log: cleanups and improvements to decouple more from logrus** ([containerd#9002](containerd#9002))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Sebastiaan van Stijn
* Akihiro Suda
* Wei Fu
* Derek McGowan
* Akhil Mohan
* Cardy.Tang
* Danny Canter
* Kazuyoshi Kato
* Mike Brown
* Phil Estes
* Samuel Karp

<details><summary>45 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.24 ([containerd#9087](containerd#9087))
  * [`cdd59290d`](containerd@cdd5929) Prepare release notes for v1.6.24
* [release/1.6 backport] log: cleanups and improvements to decouple more from logrus ([containerd#9002](containerd#9002))
  * [`33c2d88e7`](containerd@33c2d88) Revert "log: define G() as a function instead of a variable"
  * [`0a7f2975e`](containerd@0a7f297) log: swap logrus functions with their equivalent on default logger
  * [`9d175a19b`](containerd@9d175a1) log: add package documentation and summary of package's purpose
  * [`96fb65529`](containerd@96fb655) log: make Fields type a generic map[string]any
  * [`bace17e2e`](containerd@bace17e) log: add log.Entry type
  * [`dd127885f`](containerd@dd12788) log: define OutputFormat type
  * [`5b4cf2329`](containerd@5b4cf23) log: define G() as a function instead of a variable
  * [`ee1b4a1e2`](containerd@ee1b4a1) log: add all log-levels that are accepted
  * [`d563a411f`](containerd@d563a41) log: group "enum" consts and touch-up docs
  * [`6e8f4555b`](containerd@6e8f455) log: WithLogger: remove redundant intermediate var
  * [`c19325559`](containerd@c193255) log: SetFormat: include returns in switch
  * [`c3c22f8cb`](containerd@c3c22f8) log: remove gotest.tools dependency
* [release/1.6] update to go1.20.8 ([containerd#9073](containerd#9073))
  * [`a2c294800`](containerd@a2c2948) [release/1.6] update to go1.20.8
* [release/1.6 backport] make repositories of install dependencies configurable ([containerd#9024](containerd#9024))
  * [`0da8dcaa7`](containerd@0da8dca) make repositories of install dependencies configurable
* [release/1.6 backport] update Golang to go1.20.7, minimum version go1.19 ([containerd#9020](containerd#9020))
  * [`8e6a9de5b`](containerd@8e6a9de) update to go1.20.7, go1.19.12
  * [`8b2eb371f`](containerd@8b2eb37) Update Go to 1.20.6,1.19.11
  * [`cff669c7a`](containerd@cff669c) update go to go1.20.5, go1.19.10
  * [`f34a22de9`](containerd@f34a22d) update go to go1.20.4, go1.19.9
  * [`e8e73065e`](containerd@e8e7306) update go to go1.20.3, go1.19.8
  * [`9b3f950d6`](containerd@9b3f950) Go 1.20.2
  * [`17d03ac68`](containerd@17d03ac) Go 1.20.1
  * [`861f65447`](containerd@861f654) go.mod: go 1.19
  * [`81fa93784`](containerd@81fa937) Stop using math/rand.Read and rand.Seed (deprecated in Go 1.20)
  * [`70dc11a6c`](containerd@70dc11a) lint: remove `//nolint:dupword` that are no longer needed
  * [`fec784a06`](containerd@fec784a) lint: silence "SA1019: tar.TypeRegA has been deprecated... (staticheck)"
  * [`6648df1ad`](containerd@6648df1) lint: silence "type `HostFileConfig` is unused (unused)"
  * [`e6b268bc7`](containerd@e6b268b) golangci-lint v1.51.1
  * [`c552ccf67`](containerd@c552ccf) go.mod: golang.org/x/sync v0.1.0
* [releases/1.6] *: fix leaked shim caused by high IO pressure ([containerd#9004](containerd#9004))
  * [`d00af5c3e`](containerd@d00af5c) integration: issue7496 case should work for runc.v2 only
  * [`583696e4e`](containerd@583696e) Vagrantfile: add strace tool
  * [`ab21d60d2`](containerd@ab21d60) pkg/cri/server: add criService as argument when handle exit event
  * [`a229883cb`](containerd@a229883) pkg/cri/server: fix leaked shim issue
  * [`d8f824200`](containerd@d8f8242) integration: add case to reproduce containerd#7496
* [release/1.6] Cherry-pick: [overlay] add configurable mount options to overlay snapshotter ([containerd#8961](containerd#8961))
  * [`8cd40e1d0`](containerd@8cd40e1) Add configurable mount options to overlay
  * [`453fa397a`](containerd@453fa39) feat: make overlay sync removal configurable
* [release/1.6 backport] update runc binary to v1.1.9 ([containerd#8966](containerd#8966))
  * [`4cb7764df`](containerd@4cb7764) update runc binary to v1.1.9
</p>
</details>

* **golang.org/x/sync**  036812b2e83c -> v0.1.0

Previous release can be found at [v1.6.23](https://github.com/containerd/containerd/releases/tag/v1.6.23)
aravindhp added a commit to openshift/containerd that referenced this pull request Sep 16, 2023
@aravindhp
Merge tag 'v1.6.24' into release-4.12
b93c35c 
containerd 1.6.24

Welcome to the v1.6.24 release of containerd!

The twenty-fourth patch release for containerd 1.6 contains various fixes and updates.

* **CRI: fix leaked shim caused by high IO pressure** ([containerd#9004](containerd#9004))
* **Update to go1.20.8** ([containerd#9073](containerd#9073))
* **Update runc to v1.1.9** ([containerd#8966](containerd#8966))
* **Backport: add configurable mount options to overlay snapshotter** ([containerd#8961](containerd#8961))
* **log: cleanups and improvements to decouple more from logrus** ([containerd#9002](containerd#9002))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Sebastiaan van Stijn
* Akihiro Suda
* Wei Fu
* Derek McGowan
* Akhil Mohan
* Cardy.Tang
* Danny Canter
* Kazuyoshi Kato
* Mike Brown
* Phil Estes
* Samuel Karp

<details><summary>45 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.24 ([containerd#9087](containerd#9087))
  * [`cdd59290d`](containerd@cdd5929) Prepare release notes for v1.6.24
* [release/1.6 backport] log: cleanups and improvements to decouple more from logrus ([containerd#9002](containerd#9002))
  * [`33c2d88e7`](containerd@33c2d88) Revert "log: define G() as a function instead of a variable"
  * [`0a7f2975e`](containerd@0a7f297) log: swap logrus functions with their equivalent on default logger
  * [`9d175a19b`](containerd@9d175a1) log: add package documentation and summary of package's purpose
  * [`96fb65529`](containerd@96fb655) log: make Fields type a generic map[string]any
  * [`bace17e2e`](containerd@bace17e) log: add log.Entry type
  * [`dd127885f`](containerd@dd12788) log: define OutputFormat type
  * [`5b4cf2329`](containerd@5b4cf23) log: define G() as a function instead of a variable
  * [`ee1b4a1e2`](containerd@ee1b4a1) log: add all log-levels that are accepted
  * [`d563a411f`](containerd@d563a41) log: group "enum" consts and touch-up docs
  * [`6e8f4555b`](containerd@6e8f455) log: WithLogger: remove redundant intermediate var
  * [`c19325559`](containerd@c193255) log: SetFormat: include returns in switch
  * [`c3c22f8cb`](containerd@c3c22f8) log: remove gotest.tools dependency
* [release/1.6] update to go1.20.8 ([containerd#9073](containerd#9073))
  * [`a2c294800`](containerd@a2c2948) [release/1.6] update to go1.20.8
* [release/1.6 backport] make repositories of install dependencies configurable ([containerd#9024](containerd#9024))
  * [`0da8dcaa7`](containerd@0da8dca) make repositories of install dependencies configurable
* [release/1.6 backport] update Golang to go1.20.7, minimum version go1.19 ([containerd#9020](containerd#9020))
  * [`8e6a9de5b`](containerd@8e6a9de) update to go1.20.7, go1.19.12
  * [`8b2eb371f`](containerd@8b2eb37) Update Go to 1.20.6,1.19.11
  * [`cff669c7a`](containerd@cff669c) update go to go1.20.5, go1.19.10
  * [`f34a22de9`](containerd@f34a22d) update go to go1.20.4, go1.19.9
  * [`e8e73065e`](containerd@e8e7306) update go to go1.20.3, go1.19.8
  * [`9b3f950d6`](containerd@9b3f950) Go 1.20.2
  * [`17d03ac68`](containerd@17d03ac) Go 1.20.1
  * [`861f65447`](containerd@861f654) go.mod: go 1.19
  * [`81fa93784`](containerd@81fa937) Stop using math/rand.Read and rand.Seed (deprecated in Go 1.20)
  * [`70dc11a6c`](containerd@70dc11a) lint: remove `//nolint:dupword` that are no longer needed
  * [`fec784a06`](containerd@fec784a) lint: silence "SA1019: tar.TypeRegA has been deprecated... (staticheck)"
  * [`6648df1ad`](containerd@6648df1) lint: silence "type `HostFileConfig` is unused (unused)"
  * [`e6b268bc7`](containerd@e6b268b) golangci-lint v1.51.1
  * [`c552ccf67`](containerd@c552ccf) go.mod: golang.org/x/sync v0.1.0
* [releases/1.6] *: fix leaked shim caused by high IO pressure ([containerd#9004](containerd#9004))
  * [`d00af5c3e`](containerd@d00af5c) integration: issue7496 case should work for runc.v2 only
  * [`583696e4e`](containerd@583696e) Vagrantfile: add strace tool
  * [`ab21d60d2`](containerd@ab21d60) pkg/cri/server: add criService as argument when handle exit event
  * [`a229883cb`](containerd@a229883) pkg/cri/server: fix leaked shim issue
  * [`d8f824200`](containerd@d8f8242) integration: add case to reproduce containerd#7496
* [release/1.6] Cherry-pick: [overlay] add configurable mount options to overlay snapshotter ([containerd#8961](containerd#8961))
  * [`8cd40e1d0`](containerd@8cd40e1) Add configurable mount options to overlay
  * [`453fa397a`](containerd@453fa39) feat: make overlay sync removal configurable
* [release/1.6 backport] update runc binary to v1.1.9 ([containerd#8966](containerd#8966))
  * [`4cb7764df`](containerd@4cb7764) update runc binary to v1.1.9
</p>
</details>

* **golang.org/x/sync**  036812b2e83c -> v0.1.0

Previous release can be found at [v1.6.23](https://github.com/containerd/containerd/releases/tag/v1.6.23)
aravindhp added a commit to openshift/containerd that referenced this pull request Sep 16, 2023
@aravindhp
Merge tag 'v1.6.24' into release-4.11
38d6e91 
containerd 1.6.24

Welcome to the v1.6.24 release of containerd!

The twenty-fourth patch release for containerd 1.6 contains various fixes and updates.

* **CRI: fix leaked shim caused by high IO pressure** ([containerd#9004](containerd#9004))
* **Update to go1.20.8** ([containerd#9073](containerd#9073))
* **Update runc to v1.1.9** ([containerd#8966](containerd#8966))
* **Backport: add configurable mount options to overlay snapshotter** ([containerd#8961](containerd#8961))
* **log: cleanups and improvements to decouple more from logrus** ([containerd#9002](containerd#9002))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Sebastiaan van Stijn
* Akihiro Suda
* Wei Fu
* Derek McGowan
* Akhil Mohan
* Cardy.Tang
* Danny Canter
* Kazuyoshi Kato
* Mike Brown
* Phil Estes
* Samuel Karp

<details><summary>45 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.24 ([containerd#9087](containerd#9087))
  * [`cdd59290d`](containerd@cdd5929) Prepare release notes for v1.6.24
* [release/1.6 backport] log: cleanups and improvements to decouple more from logrus ([containerd#9002](containerd#9002))
  * [`33c2d88e7`](containerd@33c2d88) Revert "log: define G() as a function instead of a variable"
  * [`0a7f2975e`](containerd@0a7f297) log: swap logrus functions with their equivalent on default logger
  * [`9d175a19b`](containerd@9d175a1) log: add package documentation and summary of package's purpose
  * [`96fb65529`](containerd@96fb655) log: make Fields type a generic map[string]any
  * [`bace17e2e`](containerd@bace17e) log: add log.Entry type
  * [`dd127885f`](containerd@dd12788) log: define OutputFormat type
  * [`5b4cf2329`](containerd@5b4cf23) log: define G() as a function instead of a variable
  * [`ee1b4a1e2`](containerd@ee1b4a1) log: add all log-levels that are accepted
  * [`d563a411f`](containerd@d563a41) log: group "enum" consts and touch-up docs
  * [`6e8f4555b`](containerd@6e8f455) log: WithLogger: remove redundant intermediate var
  * [`c19325559`](containerd@c193255) log: SetFormat: include returns in switch
  * [`c3c22f8cb`](containerd@c3c22f8) log: remove gotest.tools dependency
* [release/1.6] update to go1.20.8 ([containerd#9073](containerd#9073))
  * [`a2c294800`](containerd@a2c2948) [release/1.6] update to go1.20.8
* [release/1.6 backport] make repositories of install dependencies configurable ([containerd#9024](containerd#9024))
  * [`0da8dcaa7`](containerd@0da8dca) make repositories of install dependencies configurable
* [release/1.6 backport] update Golang to go1.20.7, minimum version go1.19 ([containerd#9020](containerd#9020))
  * [`8e6a9de5b`](containerd@8e6a9de) update to go1.20.7, go1.19.12
  * [`8b2eb371f`](containerd@8b2eb37) Update Go to 1.20.6,1.19.11
  * [`cff669c7a`](containerd@cff669c) update go to go1.20.5, go1.19.10
  * [`f34a22de9`](containerd@f34a22d) update go to go1.20.4, go1.19.9
  * [`e8e73065e`](containerd@e8e7306) update go to go1.20.3, go1.19.8
  * [`9b3f950d6`](containerd@9b3f950) Go 1.20.2
  * [`17d03ac68`](containerd@17d03ac) Go 1.20.1
  * [`861f65447`](containerd@861f654) go.mod: go 1.19
  * [`81fa93784`](containerd@81fa937) Stop using math/rand.Read and rand.Seed (deprecated in Go 1.20)
  * [`70dc11a6c`](containerd@70dc11a) lint: remove `//nolint:dupword` that are no longer needed
  * [`fec784a06`](containerd@fec784a) lint: silence "SA1019: tar.TypeRegA has been deprecated... (staticheck)"
  * [`6648df1ad`](containerd@6648df1) lint: silence "type `HostFileConfig` is unused (unused)"
  * [`e6b268bc7`](containerd@e6b268b) golangci-lint v1.51.1
  * [`c552ccf67`](containerd@c552ccf) go.mod: golang.org/x/sync v0.1.0
* [releases/1.6] *: fix leaked shim caused by high IO pressure ([containerd#9004](containerd#9004))
  * [`d00af5c3e`](containerd@d00af5c) integration: issue7496 case should work for runc.v2 only
  * [`583696e4e`](containerd@583696e) Vagrantfile: add strace tool
  * [`ab21d60d2`](containerd@ab21d60) pkg/cri/server: add criService as argument when handle exit event
  * [`a229883cb`](containerd@a229883) pkg/cri/server: fix leaked shim issue
  * [`d8f824200`](containerd@d8f8242) integration: add case to reproduce containerd#7496
* [release/1.6] Cherry-pick: [overlay] add configurable mount options to overlay snapshotter ([containerd#8961](containerd#8961))
  * [`8cd40e1d0`](containerd@8cd40e1) Add configurable mount options to overlay
  * [`453fa397a`](containerd@453fa39) feat: make overlay sync removal configurable
* [release/1.6 backport] update runc binary to v1.1.9 ([containerd#8966](containerd#8966))
  * [`4cb7764df`](containerd@4cb7764) update runc binary to v1.1.9
</p>
</details>

* **golang.org/x/sync**  036812b2e83c -> v0.1.0

Previous release can be found at [v1.6.23](https://github.com/containerd/containerd/releases/tag/v1.6.23)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

@fuweid fuweid fuweid approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@thaJeztah @AkihiroSuda @fuweid