Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[NET-5574] Update Go version to 1.20.8 #2936

Merged
merged 1 commit into from
Sep 12, 2023

Conversation

zalimeni
Copy link
Member

@zalimeni zalimeni commented Sep 11, 2023

This brings us up to the latest Go version and resolves several CVEs:

  • CVE-2023-39320: cmd/go: go.mod toolchain directive allows arbitrary execution
  • CVE-2023-39318: html/template: improper handling of HTML-like comments within script contexts
  • CVE-2023-39319: html/template: improper handling of special tags within script contexts
  • CVE-2023-39321 and CVE-2023-39322: crypto/tls: panic when processing post-handshake message on QUIC connections

Note that 1.0.x uses Go 1.19, so a separate PR will "backport" this change there.

How I've tested this PR: CI

How I expect reviewers to test this PR: 👀

Checklist:

@zalimeni zalimeni added backport/1.0.x backport/1.1.x Backport to release/1.1.x branch backport/1.2.x This release branch is no longer active. and removed backport/1.0.x labels Sep 11, 2023
@zalimeni zalimeni force-pushed the zalimeni/net-5574-bump-go-1.20.8 branch from 1f13013 to 3fb16ed Compare September 11, 2023 15:51
@zalimeni zalimeni marked this pull request as ready for review September 11, 2023 15:52
@zalimeni zalimeni enabled auto-merge (squash) September 11, 2023 20:58
@zalimeni
Copy link
Member Author

zalimeni commented Sep 11, 2023

FYI, acceptance tests for Vault are currently broken due to a faulty test, and should not be affected by this change.

Rebased to include test fix.

This resolves several CVEs (see changelog entry).
@zalimeni zalimeni force-pushed the zalimeni/net-5574-bump-go-1.20.8 branch from 3fb16ed to 63b158c Compare September 12, 2023 13:43
@zalimeni zalimeni merged commit e20ff98 into main Sep 12, 2023
3 checks passed
@zalimeni zalimeni deleted the zalimeni/net-5574-bump-go-1.20.8 branch September 12, 2023 15:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport/1.1.x Backport to release/1.1.x branch backport/1.2.x This release branch is no longer active.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants