Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[20.10 backport] Update golang to 1.18.5 #3746

Merged
merged 9 commits into from Aug 19, 2022
Merged

[20.10 backport] Update golang to 1.18.5 #3746

merged 9 commits into from Aug 19, 2022

Conversation

thaJeztah
Copy link
Member

@thaJeztah thaJeztah added this to the 20.10.18 milestone Aug 19, 2022
@thaJeztah
Copy link
Member Author

hm, okay; I was somewhat expecting this one; should be easy to fix (I think there's a PR I can backport for that)

This one is more interesting; nil pointer in two tests;

=== Failed
=== FAIL: cli/command/context TestExportKubeconfig (0.00s)
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
	panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x40fcbc]

goroutine 14 [running]:
testing.tRunner.func1.2({0xbdea00, 0x12fe590})
	/usr/local/go/src/testing/testing.go:1389 +0x24e
testing.tRunner.func1()
	/usr/local/go/src/testing/testing.go:1392 +0x39f
panic({0xbdea00, 0x12fe590})
	/usr/local/go/src/runtime/panic.go:838 +0x207
reflect.mapiternext(0x40?)
	/usr/local/go/src/runtime/map.go:1378 +0x19
github.com/docker/cli/vendor/github.com/modern-go/reflect2.(*UnsafeMapIterator).UnsafeNext(0x8?)
	/go/src/github.com/docker/cli/vendor/github.com/modern-go/reflect2/unsafe_map.go:136 +0x32
github.com/docker/cli/vendor/github.com/json-iterator/go.(*sortKeysMapEncoder).Encode(0xc000446e10, 0xc00050cea8, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_map.go:293 +0x335
github.com/docker/cli/vendor/github.com/json-iterator/go.(*placeholderEncoder).Encode(0xc000177040?, 0xa8dea7?, 0xc000154df8?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:327 +0x22
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structFieldEncoder).Encode(0xc0001a6b40, 0xb72928?, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:110 +0x56
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structEncoder).Encode(0xc0001a6c90, 0xcbead1?, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:158 +0x652
github.com/docker/cli/vendor/github.com/json-iterator/go.(*placeholderEncoder).Encode(0xc0001771b8?, 0xa8dea7?, 0xc000154df8?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:327 +0x22
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structFieldEncoder).Encode(0xc0001a6f00, 0xb54166?, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:110 +0x56
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structEncoder).Encode(0xc0001a6f60, 0x40aa15?, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:158 +0x652
github.com/docker/cli/vendor/github.com/json-iterator/go.(*sliceEncoder).Encode(0xc00019e3f0, 0xc000518318, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_slice.go:38 +0x2bb
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structFieldEncoder).Encode(0xc0001a7a70, 0xb57bdd?, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:110 +0x56
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structEncoder).Encode(0xc0001a7b60, 0x0?, 0xc000154de0)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:158 +0x652
github.com/docker/cli/vendor/github.com/json-iterator/go.(*OptionalEncoder).Encode(0xc00033f220?, 0x0?, 0x0?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_optional.go:74 +0xa4
github.com/docker/cli/vendor/github.com/json-iterator/go.(*onePtrEncoder).Encode(0xc00042a970, 0xc0005182c0, 0xc0003f8f30?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:214 +0x82
github.com/docker/cli/vendor/github.com/json-iterator/go.(*Stream).WriteVal(0xc000154de0, {0xc2fc40, 0xc0005182c0})
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:93 +0x158
github.com/docker/cli/vendor/github.com/json-iterator/go.(*frozenConfig).Marshal(0xc00033f220, {0xc2fc40, 0xc0005182c0})
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/config.go:299 +0xc9
github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json.(*Serializer).Encode(0xc0003ccc40?, {0xde8400?, 0xc0005182c0?}, {0xde35e0, 0xc000436c60})
	/go/src/github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go:310 +0x6d
github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning.(*codec).Encode(0xc0002e0480, {0xde83b0?, 0xc000154cc0}, {0xde35e0, 0xc000436c60})
	/go/src/github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go:231 +0x926
github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime.Encode({0x7fbded7aba58, 0xc0002e0480}, {0xde83b0, 0xc000154cc0})
	/go/src/github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/codec.go:46 +0x64
github.com/docker/cli/vendor/k8s.io/client-go/tools/clientcmd.Write(...)
	/go/src/github.com/docker/cli/vendor/k8s.io/client-go/tools/clientcmd/loader.go:469
github.com/docker/cli/cli/command/context.RunExport({0xdf0d58, 0xc00050e8c0}, 0xc000177ed8)
	/go/src/github.com/docker/cli/cli/command/context/export.go:107 +0x54a
github.com/docker/cli/cli/command/context.TestExportKubeconfig(0xc0000844e0)
	/go/src/github.com/docker/cli/cli/command/context/export-import_test.go:82 +0x225
testing.tRunner(0xc0000844e0, 0xd15108)
	/usr/local/go/src/testing/testing.go:1439 +0x102
created by testing.(*T).Run
	/usr/local/go/src/testing/testing.go:1486 +0x35f

=== FAIL: cli/context/kubernetes TestSaveLoadContexts (0.00s)
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
	panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x40fcbc]

goroutine 19 [running]:
testing.tRunner.func1.2({0xa7e080, 0x1073930})
	/usr/local/go/src/testing/testing.go:1389 +0x24e
testing.tRunner.func1()
	/usr/local/go/src/testing/testing.go:1392 +0x39f
panic({0xa7e080, 0x1073930})
	/usr/local/go/src/runtime/panic.go:838 +0x207
reflect.mapiternext(0x40?)
	/usr/local/go/src/runtime/map.go:1378 +0x19
github.com/docker/cli/vendor/github.com/modern-go/reflect2.(*UnsafeMapIterator).UnsafeNext(0x8?)
	/go/src/github.com/docker/cli/vendor/github.com/modern-go/reflect2/unsafe_map.go:136 +0x32
github.com/docker/cli/vendor/github.com/json-iterator/go.(*sortKeysMapEncoder).Encode(0xc000478930, 0xc0000ca3a8, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_map.go:293 +0x335
github.com/docker/cli/vendor/github.com/json-iterator/go.(*placeholderEncoder).Encode(0xc00046c898?, 0x95d787?, 0xc0000bae58?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:327 +0x22
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structFieldEncoder).Encode(0xc000482630, 0xa2790c?, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:110 +0x56
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structEncoder).Encode(0xc000482780, 0xb3a599?, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:158 +0x652
github.com/docker/cli/vendor/github.com/json-iterator/go.(*placeholderEncoder).Encode(0xc00046ca10?, 0x95d787?, 0xc0000bae58?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:327 +0x22
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structFieldEncoder).Encode(0xc0004829f0, 0xa0fd11?, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:110 +0x56
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structEncoder).Encode(0xc000482a50, 0x40aa15?, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:158 +0x652
github.com/docker/cli/vendor/github.com/json-iterator/go.(*sliceEncoder).Encode(0xc00047e198, 0xc0003a83c8, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_slice.go:38 +0x2bb
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structFieldEncoder).Encode(0xc0004837a0, 0xa12e12?, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:110 +0x56
github.com/docker/cli/vendor/github.com/json-iterator/go.(*structEncoder).Encode(0xc000483890, 0x0?, 0xc0000bae40)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_struct_encoder.go:158 +0x652
github.com/docker/cli/vendor/github.com/json-iterator/go.(*OptionalEncoder).Encode(0xc0003b6be0?, 0x0?, 0x0?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect_optional.go:74 +0xa4
github.com/docker/cli/vendor/github.com/json-iterator/go.(*onePtrEncoder).Encode(0xc000471e30, 0xc0003a8370, 0xc000460720?)
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:214 +0x82
github.com/docker/cli/vendor/github.com/json-iterator/go.(*Stream).WriteVal(0xc0000bae40, {0xabe4a0, 0xc0003a8370})
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/reflect.go:93 +0x158
github.com/docker/cli/vendor/github.com/json-iterator/go.(*frozenConfig).Marshal(0xc0003b6be0, {0xabe4a0, 0xc0003a8370})
	/go/src/github.com/docker/cli/vendor/github.com/json-iterator/go/config.go:299 +0xc9
github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json.(*Serializer).Encode(0xc00043aee0?, {0xc375c0?, 0xc0003a8370?}, {0xc339e0, 0xc000460210})
	/go/src/github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/json.go:310 +0x6d
github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning.(*codec).Encode(0xc0000f8480, {0xc37570?, 0xc0000bacc0}, {0xc339e0, 0xc000460210})
	/go/src/github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/versioning.go:231 +0x926
github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime.Encode({0x7f48b36ce5c0, 0xc0000f8480}, {0xc37570, 0xc0000bacc0})
	/go/src/github.com/docker/cli/vendor/k8s.io/apimachinery/pkg/runtime/codec.go:46 +0x64
github.com/docker/cli/vendor/k8s.io/client-go/tools/clientcmd.Write(...)
	/go/src/github.com/docker/cli/vendor/k8s.io/client-go/tools/clientcmd/loader.go:469
github.com/docker/cli/cli/context/kubernetes.TestSaveLoadContexts(0xc0004561a0?)
	/go/src/github.com/docker/cli/cli/context/kubernetes/endpoint_test.go:75 +0xf0a
testing.tRunner(0xc0004561a0, 0xb89ea0)
	/usr/local/go/src/testing/testing.go:1439 +0x102
created by testing.(*T).Run
	/usr/local/go/src/testing/testing.go:1486 +0x35f

@thaJeztah
Copy link
Member Author

Looks like we need to update that dependency; this version is to fix compatibility with go 1.18; https://github.com/json-iterator/go/releases/tag/v1.1.12

@thaJeztah thaJeztah mentioned this pull request Aug 19, 2022
Merged
@thaJeztah thaJeztah marked this pull request as draft August 19, 2022 14:17
@thaJeztah
[20.10] Dockerfile: use syntax=docker/dockerfile:1
f14ba9f 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
[20.10] Dockerfile.lint: use go install
b3022b9 
"go get@version" is no longer supported on newer versions of go.
Also renaming the build-arg to match what's used in master.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
staticcheck: ignore SA1019: strings.Title is deprecated
86bf196 
This function is deprecated because it has known limitations when using
with multi-byte strings. This limitations are quite "corner case", and
our use (mostly) is for ASCII strings. The suggestion replacement brings
20k+ lines of code, which is a bit too much to fix those corner cases.

    templates/templates.go:23:14: SA1019: strings.Title is deprecated: The rule Title uses for word boundaries does not handle Unicode punctuation properly. Use golang.org/x/text/cases instead. (staticcheck)
        "title":    strings.Title,
                    ^

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit bf29b40)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
update go to 1.18.0
990186f 
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 635c55d)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
update golang to 1.18.1
386d50c 
go1.18.1 (released 2022-04-12) includes security fixes to the crypto/elliptic,
crypto/x509, and encoding/pem packages, as well as bug fixes to the compiler,
linker, runtime, the go command, vet, and the bytes, crypto/x509, and go/types
packages. See the Go 1.18.1 milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.18.1+label%3ACherryPickApproved

Includes fixes for:

- CVE-2022-24675 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24675)
- CVE-2022-27536 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27536)
- CVE-2022-28327 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28327)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit c3fe1b9)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
update golang to 1.18.2
c904936 
go1.18.2 (released 2022-05-10) includes security fixes to the syscall package,
as well as bug fixes to the compiler, runtime, the go command, and the crypto/x509,
go/types, net/http/httptest, reflect, and sync/atomic packages. See the Go 1.18.2
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.18.2+label%3ACherryPickApproved

Full diff: http://github.com/golang/go/compare/go1.18.1...go1.18.2

Includes fixes for:

- CVE-2022-29526 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29526);
  (description at https://go.dev/issue/52313).

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit f5d1689)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
update golang to 1.18.3
0389090 
go1.18.3 (released 2022-06-01) includes security fixes to the crypto/rand,
crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the
compiler, and the crypto/tls and text/template/parse packages. See the Go
1.18.3 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.18.3+label%3ACherryPickApproved

Hello gophers,

We have just released Go versions 1.18.3 and 1.17.11, minor point releases.

These minor releases include 4 security fixes following the security policy:

- crypto/rand: rand.Read hangs with extremely large buffers
  On Windows, rand.Read will hang indefinitely if passed a buffer larger than
  1 << 32 - 1 bytes.

  Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset,
  for reporting this issue.

  This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561.
- crypto/tls: session tickets lack random ticket_age_add
  Session tickets generated by crypto/tls did not contain a randomly generated
  ticket_age_add. This allows an attacker that can observe TLS handshakes to
  correlate successive connections by comparing ticket ages during session
  resumption.

  Thanks to GitHub user nervuri for reporting this.

  This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814.
- `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows

  If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput`
  are executed when Cmd.Path is unset and, in the working directory, there are
  binaries named either "..com" or "..exe", they will be executed.

  Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting
  this.

  This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574.
- `path/filepath`: Clean(`.\c:`) returns `c:` on Windows

  On Windows, the `filepath.Clean` function could convert an invalid path to a
  valid, absolute path. For example, Clean(`.\c:`) returned `c:`.

  Thanks to Unrud for reporting this issue.

  This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476.

[CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634
[CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629
[CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580
[CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit aa720f1)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
update golang to 1.18.4
c70b01e 
go1.18.4 (released 2022-07-12) includes security fixes to the compress/gzip,
encoding/gob, encoding/xml, go/parser, io/fs, net/http, and path/filepath
packages, as well as bug fixes to the compiler, the go command, the linker,
the runtime, and the runtime/metrics package. See the Go 1.18.4 milestone on the
issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.18.4+label%3ACherryPickApproved

This update addresses:

CVE-2022-1705, CVE-2022-1962, CVE-2022-28131, CVE-2022-30630, CVE-2022-30631,
CVE-2022-30632, CVE-2022-30633, CVE-2022-30635, and CVE-2022-32148.

Full diff: golang/go@go1.18.3...go1.18.4

From the security announcement;
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE

We have just released Go versions 1.18.4 and 1.17.12, minor point releases. These
minor releases include 9 security fixes following the security policy:

- net/http: improper sanitization of Transfer-Encoding header

  The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating
  a "chunked" encoding. This could potentially allow for request smuggling, but
  only if combined with an intermediate server that also improperly failed to
  reject the header as invalid.

  This is CVE-2022-1705 and https://go.dev/issue/53188.

- When `httputil.ReverseProxy.ServeHTTP` was called with a `Request.Header` map
  containing a nil value for the X-Forwarded-For header, ReverseProxy would set
  the client IP as the value of the X-Forwarded-For header, contrary to its
  documentation. In the more usual case where a Director function set the
  X-Forwarded-For header value to nil, ReverseProxy would leave the header
  unmodified as expected.

  This is https://go.dev/issue/53423 and CVE-2022-32148.

  Thanks to Christian Mehlmauer for reporting this issue.

- compress/gzip: stack exhaustion in Reader.Read

  Calling Reader.Read on an archive containing a large number of concatenated
  0-length compressed files can cause a panic due to stack exhaustion.

  This is CVE-2022-30631 and Go issue https://go.dev/issue/53168.

- encoding/xml: stack exhaustion in Unmarshal

  Calling Unmarshal on a XML document into a Go struct which has a nested field
  that uses the any field tag can cause a panic due to stack exhaustion.

  This is CVE-2022-30633 and Go issue https://go.dev/issue/53611.

- encoding/xml: stack exhaustion in Decoder.Skip

  Calling Decoder.Skip when parsing a deeply nested XML document can cause a
  panic due to stack exhaustion. The Go Security team discovered this issue, and
  it was independently reported by Juho Nurminen of Mattermost.

  This is CVE-2022-28131 and Go issue https://go.dev/issue/53614.

- encoding/gob: stack exhaustion in Decoder.Decode

  Calling Decoder.Decode on a message which contains deeply nested structures
  can cause a panic due to stack exhaustion.

  This is CVE-2022-30635 and Go issue https://go.dev/issue/53615.

- path/filepath: stack exhaustion in Glob

  Calling Glob on a path which contains a large number of path separators can
  cause a panic due to stack exhaustion.

  Thanks to Juho Nurminen of Mattermost for reporting this issue.

  This is CVE-2022-30632 and Go issue https://go.dev/issue/53416.

- io/fs: stack exhaustion in Glob

  Calling Glob on a path which contains a large number of path separators can
  cause a panic due to stack exhaustion.

  This is CVE-2022-30630 and Go issue https://go.dev/issue/53415.

- go/parser: stack exhaustion in all Parse* functions

  Calling any of the Parse functions on Go source code which contains deeply
  nested types or declarations can cause a panic due to stack exhaustion.

  Thanks to Juho Nurminen of Mattermost for reporting this issue.

  This is CVE-2022-1962 and Go issue https://go.dev/issue/53616.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 046e7e6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
Update golang to 1.18.5
bdac0b3 
Update Go runtime to 1.18.5 to address CVE-2022-32189.

Full diff: golang/go@go1.18.4...go1.18.5

--------------------------------------------------------

From the security announcement:
https://groups.google.com/g/golang-announce/c/YqYYG87xB10

We have just released Go versions 1.18.5 and 1.17.13, minor point
releases.

These minor releases include 1 security fixes following the security
policy:

encoding/gob & math/big: decoding big.Float and big.Rat can panic

Decoding big.Float and big.Rat types can panic if the encoded message is
too short.

This is CVE-2022-32189 and Go issue https://go.dev/issue/53871.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.18.5

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 6191b66)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah thaJeztah marked this pull request as ready for review August 19, 2022 14:58
@codecov-commenter
Copy link

codecov-commenter commented Aug 19, 2022 •
edited

Codecov Report

Merging #3746 (ae45936) into 20.10 (ae45936) will not change coverage.
The diff coverage is n/a.

❗ Current head ae45936 differs from pull request most recent head bdac0b3. Consider uploading reports for the commit bdac0b3 to get more accurate results

@@           Coverage Diff           @@
##            20.10    #3746   +/-   ##
=======================================
  Coverage   58.57%   58.57%           
=======================================
  Files         299      299           
  Lines       21457    21457           
=======================================
  Hits        12569    12569           
  Misses       7970     7970           
  Partials      918      918

@thaJeztah thaJeztah merged commit 0785bd7 into docker:20.10 Aug 19, 2022
@thaJeztah thaJeztah deleted the 20.10_backport_bump_go_1.18 branch August 19, 2022 15:19
This was referenced Mar 20, 2023
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vvoland vvoland vvoland approved these changes

Assignees
No one assigned
Labels
area/packaging impact/changelog status/2-code-review
Projects
None yet
Milestone
20.10.18
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@thaJeztah @codecov-commenter @vvoland