From 0f3cbbc035aa46dfa3267d44b858cb16966c1712 Mon Sep 17 00:00:00 2001 From: Lucas Roesler Date: Thu, 22 Aug 2019 14:14:16 +0200 Subject: [PATCH] Bump go version to 1.11.13 **What** - Using the base golang:1.11 docker image so that we can easily track security patches for go 1.11. In particular this includes go 1.11.13, which address https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg > net/http: Denial of Service vulnerabilities in the HTTP/2 implementation > > net/http and golang.org/x/net/http2 servers that accept direct connections > from untrusted clients could be remotely made to allocate an unlimited amount > of memory, until the program crashes. Servers will now close connections if > the send queue accumulates too many control messages. > > net/url: parsing validation issue > > url.Parse would accept URLs with malformed hosts, such that the Host field > could have arbitrary suffixes that would appear in neither Hostname() nor > Port(), allowing authorization bypasses in certain applications. Note that URLs > with invalid, not numeric ports will now return an error from url.Parse. Signed-off-by: Lucas Roesler --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index db53e11d..51749a17 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.10 +FROM golang:1.11 RUN mkdir -p /go/src/github.com/openfaas-incubator/of-watchdog WORKDIR /go/src/github.com/openfaas-incubator/of-watchdog