Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: update Go to 1.16.6 #140

Merged
merged 1 commit into from
Jul 13, 2021
Merged

feat: update Go to 1.16.6 #140

merged 1 commit into from
Jul 13, 2021

Conversation

smira
Copy link
Member

@smira smira commented Jul 13, 2021

See https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ/m/4ZhvTx0dAQAJ

These minor releases include a security fix according to the new security policy.

crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters.
net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker
in a privileged network position without access to the server certificate's private key, as long as a trusted
ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with
Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher
suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.

Signed-off-by: Andrey Smirnov smirnov.andrey@gmail.com

See https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ/m/4ZhvTx0dAQAJ

These minor releases include a security fix according to the new security policy.

> crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters.
> net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker
> in a privileged network position without access to the server certificate's private key, as long as a trusted
> ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with
> Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher
> suites without ECDHE), as well as TLS 1.3-only clients, are unaffected.

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
@smira
Copy link
Member Author

smira commented Jul 13, 2021

/approve

@smira
Copy link
Member Author

smira commented Jul 13, 2021

/lgtm

@talos-bot talos-bot merged commit 7172a5d into siderolabs:master Jul 13, 2021
smira added a commit to smira/pkgs that referenced this pull request Jul 13, 2021
See siderolabs/tools#140

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
talos-bot pushed a commit to smira/pkgs that referenced this pull request Jul 13, 2021
See siderolabs/tools#140

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
talos-bot pushed a commit to siderolabs/pkgs that referenced this pull request Jul 13, 2021
See siderolabs/tools#140

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
smira added a commit to smira/extras that referenced this pull request Jul 13, 2021
See siderolabs/pkgs#300

See siderolabs/tools#140

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
talos-bot pushed a commit to siderolabs/extras that referenced this pull request Jul 13, 2021
See siderolabs/pkgs#300

See siderolabs/tools#140

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
smira added a commit to smira/talos that referenced this pull request Jul 13, 2021
See:

* siderolabs/tools#140
* siderolabs/pkgs#300
* siderolabs/extras#21

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
smira added a commit to smira/talos that referenced this pull request Jul 13, 2021
See:

* siderolabs/tools#140
* siderolabs/pkgs#300
* siderolabs/extras#21

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
talos-bot pushed a commit to siderolabs/talos that referenced this pull request Jul 14, 2021
See:

* siderolabs/tools#140
* siderolabs/pkgs#300
* siderolabs/extras#21

Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants