[NET-4865] security: Bump golang.org/x/net to 0.12.0#18186
Conversation
zalimeni
added
theme/security
backport/1.14
backport/1.15
github-actions
bot
added
pr/dependencies
zalimeni
force-pushed
the
zalimeni/net-4865-bump-net_http-cve
branch
from
1964386 to
9e395b5
Compare
DanStough
left a comment
DanStough
left a comment
There was a problem hiding this comment.
LGTM, but I think you'll want to run a go mod tidy in test/integration/consul-container to update there as well and prevent linting errors.
go.mod
Outdated
There was a problem hiding this comment.
This was a pretty notable side-effect of this bump. The first release was Oct '22, so not as long ago as it might seem.
While not necessary to directly address CVE-2023-29406 (which should be handled by using a patched version of Go when building), an accompanying change to HTTP/2 error handling does impact agent code. See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2 change. Bump this dependency across our submodules as well for the sake of potential indirect consumers of `x/net/http`.
zalimeni
force-pushed
the
zalimeni/net-4865-bump-net_http-cve
branch
from
9e395b5 to
84cbf09
Compare
Thanks @DanStough , good catch. Did there and in I also realized I should go ahead and set Go build versions across the board - first pass (failed) grepping led me to believe that had been moved to a common repo, but just found them based on an old PR. Until #18124 is resolved, I'll leave those test-specific versions pinned on 1.20.5. I'll do the Go bump in a follow-up PR for the sake of brevity. |
zalimeni
changed the title
While not necessary to directly address CVE-2023-29406 (which should be handled by using a patched version of Go when building), an accompanying change to HTTP/2 error handling does impact agent code.
See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2 change.
Bump this dependency across our submodules as well for the sake of potential indirect consumers of
x/net/http.Description
Resolves CVE-2023-29406 regarding
net/httpinconsuland submodules.Testing & Reproduction steps
Tests should continue to pass.
Links
https://nvd.nist.gov/vuln/detail/CVE-2023-29406
https://go-review.googlesource.com/c/go/+/506996
https://go-review.googlesource.com/c/net/+/506995
PR Checklist