Skip to content

update to go1.21.12#12017

Merged
glours merged 1 commit intodocker:mainfrom
thaJeztah:bump_go
Jul 25, 2024
Merged

update to go1.21.12#12017
glours merged 1 commit intodocker:mainfrom
thaJeztah:bump_go

Conversation

@thaJeztah
Copy link
Member

@thaJeztah thaJeztah commented Jul 24, 2024

go1.21.12 (released 2024-07-02) includes security fixes to the net/http package, as well as bug fixes to the compiler, the go command, the runtime, and the crypto/x509, net/http, net/netip, and os packages. See the Go 1.21.12 milestone on our issue tracker for details:

From the security mailing:

Hello gophers,

We have just released Go versions 1.22.5 and 1.21.12, minor point releases.

These minor releases include 1 security fixes following the security policy:

  • net/http: denial of service due to improper 100-continue handling

    The net/http HTTP/1.1 client mishandled the case where a server responds
    to a request with an “Expect: 100-continue” header with a non-informational
    (200 or higher) status. This mishandling could leave a client connection
    in an invalid state, where the next request sent on the connection will fail.

An attacker sending a request to a net/http/httputil.ReverseProxy proxy can
exploit this mishandling to cause a denial of service by sending
“Expect: 100-continue” requests which elicit a non-informational response
from the backend. Each such request leaves the proxy with an invalid connection,
and causes one subsequent request using that connection to fail.

Thanks to Geoff Franks for reporting this issue.

This is CVE-2024-24791 and Go issue https://go.dev/issue/67555.

What I did

Related issue

(not mandatory) A picture of a cute animal, if possible in relation to what you did

@thaJeztah
update to go1.21.12
7b5ef0f 
go1.21.12 (released 2024-07-02) includes security fixes to the net/http package,
as well as bug fixes to the compiler, the go command, the runtime, and the
crypto/x509, net/http, net/netip, and os packages. See the Go 1.21.12 milestone
on our issue tracker for details:

- https://github.com/golang/go/issues?q=milestone%3AGo1.21.12+label%3ACherryPickApproved
- full diff: golang/go@go1.21.11...go1.21.12

From the security mailing:

> Hello gophers,
>
> We have just released Go versions 1.22.5 and 1.21.12, minor point releases.
>
> These minor releases include 1 security fixes following the security policy:
>
> * net/http: denial of service due to improper 100-continue handling
>
>   The net/http HTTP/1.1 client mishandled the case where a server responds
>   to a request with an “Expect: 100-continue” header with a non-informational
>   (200 or higher) status. This mishandling could leave a client connection
>   in an invalid state, where the next request sent on the connection will fail.
>
> An attacker sending a request to a net/http/httputil.ReverseProxy proxy can
> exploit this mishandling to cause a denial of service by sending
> “Expect: 100-continue” requests which elicit a non-informational response
> from the backend. Each such request leaves the proxy with an invalid connection,
> and causes one subsequent request using that connection to fail.
>
> Thanks to Geoff Franks for reporting this issue.
>
> This is CVE-2024-24791 and Go issue https://go.dev/issue/67555.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@glours glours merged commit 3f55382 into docker:main Jul 25, 2024
@thaJeztah thaJeztah deleted the bump_go branch July 25, 2024 10:25
@BrewTestBot BrewTestBot mentioned this pull request Aug 16, 2024
Merged
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Aug 20, 2024
@tmeijn
build(deps): update docker/compose to v2.29.2
9b479f0 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [docker/compose](https://github.com/docker/compose) | patch | `v2.29.1` -> `v2.29.2` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>docker/compose (docker/compose)</summary>

### [`v2.29.2`](https://github.com/docker/compose/releases/tag/v2.29.2)

[Compare Source](docker/compose@v2.29.1...v2.29.2)

#### What's Changed

##### ✨ Improvements

-   docs: Update docker compose kill usage [(12041)](docker/compose#12041)
-   add `x-initSync` to watch to always provide initial [(12047)](docker/compose#12047)

##### 🐛 Fixes

-   Removes redundant condition from toAPIBuildOptions in build.go [(12009)](docker/compose#12009)
-   Fix stoping compose process for single container for file change on sync-restart action [(12014)](docker/compose#12014)

##### 🔧  Internal

-   bump golang `1.21.12` [(12017)](docker/compose#12017)
-   bump engine and cli to `v27.1.1`, buildx to `v0.16.1` [(12020)](docker/compose#12020)
-   bump engine and cli to `v27.1.2`, buildx to `v0.16.2`  [(12057)](docker/compose#12057)
-   remove all dependabot update MRs for OTel dependencies [(12006)](docker/compose#12006)
-   bump golang.org/x/sys `v0.22.0` and gofrs/flock `v0.12.1` [(12018)](docker/compose#12018)

#### New Contributors

-   [@&#8203;janbrasna](https://github.com/janbrasna) made their first contribution in [(12041)](docker/compose#12041)
-   [@&#8203;kapurm17](https://github.com/kapurm17) made their first contribution in [(12009)](docker/compose#12009)

**Full Changelog**: docker/compose@v2.29.1...v2.29.2

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@glours glours glours approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@thaJeztah @glours