[NET-5574] Update Go version to 1.19.13 (1.0.x) #2938

zalimeni · 2023-09-11T16:12:08Z

This brings us up to the latest Go version and resolves several CVEs:

CVE-2023-39320: cmd/go: go.mod toolchain directive allows arbitrary execution
CVE-2023-39318: html/template: improper handling of HTML-like comments within script contexts
CVE-2023-39319: html/template: improper handling of special tags within script contexts
CVE-2023-39321 and CVE-2023-39322: crypto/tls: panic when processing post-handshake message on QUIC connections

Note that 1.0.x uses Go 1.19. See #2936 for 1.20.8 change on more recent release branches.

How I've tested this PR: CI

How I expect reviewers to test this PR: 👀

Checklist:

zalimeni · 2023-09-11T21:26:37Z

~~FYI, acceptance tests for Vault are currently broken due to a faulty test, and should not be affected by this change.~~

Rebased to include test fix.

This resolves several CVEs (see changelog entry).

zalimeni added the pr/no-backport signals that a PR will not contain a backport label label Sep 11, 2023

zalimeni force-pushed the zalimeni/net-5574-bump-go-1.19.13-1.0.x branch from 711deda to a91dd3d Compare September 11, 2023 16:13

zalimeni marked this pull request as ready for review September 11, 2023 16:14

zalimeni requested review from david-yu and picatz September 11, 2023 16:14

zalimeni enabled auto-merge (squash) September 11, 2023 16:14

Update Go version to 1.19.13

02229c5

This resolves several CVEs (see changelog entry).

zalimeni force-pushed the zalimeni/net-5574-bump-go-1.19.13-1.0.x branch from a91dd3d to 02229c5 Compare September 12, 2023 13:45

picatz approved these changes Sep 12, 2023

View reviewed changes

zalimeni merged commit 0249586 into release/1.0.x Sep 12, 2023
3 checks passed

zalimeni deleted the zalimeni/net-5574-bump-go-1.19.13-1.0.x branch September 12, 2023 15:41

Provide feedback