Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[24.0] update to go1.20.10 #951

Merged
merged 2 commits into from
Oct 11, 2023
Merged

Commits on Oct 11, 2023

  1. update to go1.20.9

    go1.20.9 (released 2023-10-05) includes one security fixes to the cmd/go package,
    as well as bug fixes to the go command and the linker. See the Go 1.20.9
    milestone on our issue tracker for details:
    
    https://github.com/golang/go/issues?q=milestone%3AGo1.20.9+label%3ACherryPickApproved
    
    full diff: golang/go@go1.20.8...go1.20.9
    
    From the security mailing:
    
    [security] Go 1.21.2 and Go 1.20.9 are released
    
    Hello gophers,
    
    We have just released Go versions 1.21.2 and 1.20.9, minor point releases.
    
    These minor releases include 1 security fixes following the security policy:
    
    - cmd/go: line directives allows arbitrary execution during build
    
      "//line" directives can be used to bypass the restrictions on "//go:cgo_"
      directives, allowing blocked linker and compiler flags to be passed during
      compliation. This can result in unexpected execution of arbitrary code when
      running "go build". The line directive requires the absolute path of the file in
      which the directive lives, which makes exploting this issue significantly more
      complex.
    
      This is CVE-2023-39323 and Go issue https://go.dev/issue/63211.
    
    Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    thaJeztah committed Oct 11, 2023
    Configuration menu
    Copy the full SHA
    4b891ba View commit details
    Browse the repository at this point in the history
  2. update to go1.20.10

    go1.20.10 (released 2023-10-10) includes a security fix to the net/http package.
    See the Go 1.20.10 milestone on our issue tracker for details:
    
    https://github.com/golang/go/issues?q=milestone%3AGo1.20.10+label%3ACherryPickApproved
    
    full diff: golang/go@go1.20.9...go1.20.10
    
    From the security mailing:
    
    [security] Go 1.21.3 and Go 1.20.10 are released
    
    Hello gophers,
    
    We have just released Go versions 1.21.3 and 1.20.10, minor point releases.
    
    These minor releases include 1 security fixes following the security policy:
    
    - net/http: rapid stream resets can cause excessive work
    
      A malicious HTTP/2 client which rapidly creates requests and
      immediately resets them can cause excessive server resource consumption.
      While the total number of requests is bounded to the
      http2.Server.MaxConcurrentStreams setting, resetting an in-progress
      request allows the attacker to create a new request while the existing
      one is still executing.
    
      HTTP/2 servers now bound the number of simultaneously executing
      handler goroutines to the stream concurrency limit. New requests
      arriving when at the limit (which can only happen after the client
      has reset an existing, in-flight request) will be queued until a
      handler exits. If the request queue grows too large, the server
      will terminate the connection.
    
      This issue is also fixed in golang.org/x/net/http2 v0.17.0,
      for users manually configuring HTTP/2.
    
      The default stream concurrency limit is 250 streams (requests)
      per HTTP/2 connection. This value may be adjusted using the
      golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
      setting and the ConfigureServer function.
    
      This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
      This is also tracked by CVE-2023-44487.
    
    Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
    thaJeztah committed Oct 11, 2023
    Configuration menu
    Copy the full SHA
    5af5d58 View commit details
    Browse the repository at this point in the history