From 1ec1ae2c6b6458b5d000af1ec6263b4ee337cd58 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 8 Nov 2023 19:16:46 +0100 Subject: [PATCH] update to go1.20.11, test go1.21.4 go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package. See the Go 1.20.11 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.20.11+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.20.10...go1.20.11 from the security mailing: [security] Go 1.21.4 and Go 1.20.11 are released Hello gophers, We have just released Go versions 1.21.4 and 1.20.11, minor point releases. These minor releases include 2 security fixes following the security policy: - path/filepath: recognize `\??\` as a Root Local Device path prefix. On Windows, a path beginning with `\??\` is a Root Local Device path equivalent to a path beginning with `\\?\`. Paths with a `\??\` prefix may be used to access arbitrary locations on the system. For example, the path `\??\c:\x` is equivalent to the more common path c:\x. The filepath package did not recognize paths with a `\??\` prefix as special. Clean could convert a rooted path such as `\a\..\??\b` into the root local device path `\??\b`. It will now convert this path into `.\??\b`. `IsAbs` did not report paths beginning with `\??\` as absolute. It now does so. VolumeName now reports the `\??\` prefix as a volume name. `Join(`\`, `??`, `b`)` could convert a seemingly innocent sequence of path elements into the root local device path `\??\b`. It will now convert this to `\.\??\b`. This is CVE-2023-45283 and https://go.dev/issue/63713. - path/filepath: recognize device names with trailing spaces and superscripts The `IsLocal` function did not correctly detect reserved names in some cases: - reserved names followed by spaces, such as "COM1 ". - "COM" or "LPT" followed by a superscript 1, 2, or 3. `IsLocal` now correctly reports these names as non-local. This is CVE-2023-45284 and https://go.dev/issue/63713. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/build-test-images.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 2 +- .github/workflows/images.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- Vagrantfile | 2 +- contrib/Dockerfile.test | 2 +- script/setup/prepare_env_windows.ps1 | 2 +- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml index 532777cf5e27..2c8c7e7cd068 100644 --- a/.github/workflows/build-test-images.yml +++ b/.github/workflows/build-test-images.yml @@ -43,7 +43,7 @@ jobs: steps: - uses: actions/setup-go@v3 with: - go-version: "1.20.10" + go-version: "1.20.11" - uses: actions/checkout@v3 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 070813b9ebb2..7cc718189adc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ on: env: # Go version we currently use to build containerd across all CI. # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions. - GO_VERSION: "1.20.10" + GO_VERSION: "1.20.11" permissions: # added using https://github.com/step-security/secure-workflows contents: read @@ -207,7 +207,7 @@ jobs: strategy: matrix: os: [ubuntu-20.04, macos-12, windows-2019, windows-2022] - go-version: ["1.20.10", "1.21.3"] + go-version: ["1.20.11", "1.21.4"] steps: - uses: actions/setup-go@v3 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 02fa14e3ff7a..418af999e806 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/setup-go@v3 with: - go-version: 1.20.10 + go-version: 1.20.11 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index e2ad7bec9120..47d938c7aa6a 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -28,7 +28,7 @@ jobs: steps: - uses: actions/setup-go@v3 with: - go-version: "1.20.10" + go-version: "1.20.11" - uses: actions/checkout@v3 with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index f75defc3bbdd..ae8b816b15c7 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -7,7 +7,7 @@ on: - ".github/workflows/nightly.yml" env: - GO_VERSION: "1.20.10" + GO_VERSION: "1.20.11" permissions: # added using https://github.com/step-security/secure-workflows contents: read diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8c4bbecb08b4..8c15278757d2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ on: name: Release env: - GO_VERSION: "1.20.10" + GO_VERSION: "1.20.11" permissions: # added using https://github.com/step-security/secure-workflows contents: read diff --git a/Vagrantfile b/Vagrantfile index 7b7a3ad07155..d7133c3ae33b 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -102,7 +102,7 @@ EOF config.vm.provision "install-golang", type: "shell", run: "once" do |sh| sh.upload_path = "/tmp/vagrant-install-golang" sh.env = { - 'GO_VERSION': ENV['GO_VERSION'] || "1.20.10", + 'GO_VERSION': ENV['GO_VERSION'] || "1.20.11", } sh.inline = <<~SHELL #!/usr/bin/env bash diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test index cba1a23428c0..dd39ce07387e 100644 --- a/contrib/Dockerfile.test +++ b/contrib/Dockerfile.test @@ -29,7 +29,7 @@ # docker run --privileged containerd-test # ------------------------------------------------------------------------------ -ARG GOLANG_VERSION=1.20.10 +ARG GOLANG_VERSION=1.20.11 ARG GOLANG_IMAGE=golang FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang diff --git a/script/setup/prepare_env_windows.ps1 b/script/setup/prepare_env_windows.ps1 index f4516b461072..c6ea414fea22 100644 --- a/script/setup/prepare_env_windows.ps1 +++ b/script/setup/prepare_env_windows.ps1 @@ -5,7 +5,7 @@ # lived test environment. Set-MpPreference -DisableRealtimeMonitoring:$true -$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.10"; make = ""; nssm = "" } +$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.11"; make = ""; nssm = "" } Write-Host "Downloading chocolatey package" curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'