Commits on Jun 2, 2022

1. [release/1.5] update golang to 1.17.11 …

   go1.17.11 (released 2022-06-01) includes security fixes to the crypto/rand,
   crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the
   crypto/tls package. See the Go 1.17.11 milestone on our issue tracker for details.
   
   https://github.com/golang/go/issues?q=milestone%3AGo1.17.11+label%3ACherryPickApproved
   
   Hello gophers,
   
   We have just released Go versions 1.18.3 and 1.17.11, minor point releases.
   
   These minor releases include 4 security fixes following the security policy:
   
   - crypto/rand: rand.Read hangs with extremely large buffers
     On Windows, rand.Read will hang indefinitely if passed a buffer larger than
     1 << 32 - 1 bytes.
   
     Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset,
     for reporting this issue.
   
     This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561.
   - crypto/tls: session tickets lack random ticket_age_add
     Session tickets generated by crypto/tls did not contain a randomly generated
     ticket_age_add. This allows an attacker that can observe TLS handshakes to
     correlate successive connections by comparing ticket ages during session
     resumption.
   
     Thanks to GitHub user nervuri for reporting this.
   
     This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814.
   - `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows
   
     If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput`
     are executed when Cmd.Path is unset and, in the working directory, there are
     binaries named either "..com" or "..exe", they will be executed.
   
     Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting
     this.
   
     This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574.
   - `path/filepath`: Clean(`.\c:`) returns `c:` on Windows
   
     On Windows, the `filepath.Clean` function could convert an invalid path to a
     valid, absolute path. For example, Clean(`.\c:`) returned `c:`.
   
     Thanks to Unrud for reporting this issue.
   
     This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476.
   
   [CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634
   [CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629
   [CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580
   [CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804
   
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   thaJeztah committed Jun 2, 2022
   Copy the full SHA

   3f61d5e View commit details

   Browse the repository at this point in the history