Commits on Nov 5, 2022

1. [release/1.6] update to Go 1.18.8 to address CVE-2022-41716 …

       On Windows, syscall.StartProcess and os/exec.Cmd did not properly
       check for invalid environment variable values. A malicious
       environment variable value could exploit this behavior to set a
       value for a different environment variable. For example, the
       environment variable string "A=B\x00C=D" set the variables "A=B" and
       "C=D".
   
       Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this
       issue.
   
       This is CVE-2022-41716 and Go issue https://go.dev/issue/56284.
   
   This Go release also fixes golang/go#56309, a
   runtime bug which can cause random memory corruption when a goroutine
   exits with runtime.LockOSThread() set. This fix is necessary to unblock
   work to replace certain uses of pkg/reexec with unshared OS threads.
   
   Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

   

   thaJeztah committed Nov 5, 2022
   Copy the full SHA

   303f608 View commit details

   Browse the repository at this point in the history