From 1ec1ae2c6b6458b5d000af1ec6263b4ee337cd58 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Wed, 8 Nov 2023 19:16:46 +0100 Subject: [PATCH 1/2] update to go1.20.11, test go1.21.4 go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package. See the Go 1.20.11 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.20.11+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.20.10...go1.20.11 from the security mailing: [security] Go 1.21.4 and Go 1.20.11 are released Hello gophers, We have just released Go versions 1.21.4 and 1.20.11, minor point releases. These minor releases include 2 security fixes following the security policy: - path/filepath: recognize `\??\` as a Root Local Device path prefix. On Windows, a path beginning with `\??\` is a Root Local Device path equivalent to a path beginning with `\\?\`. Paths with a `\??\` prefix may be used to access arbitrary locations on the system. For example, the path `\??\c:\x` is equivalent to the more common path c:\x. The filepath package did not recognize paths with a `\??\` prefix as special. Clean could convert a rooted path such as `\a\..\??\b` into the root local device path `\??\b`. It will now convert this path into `.\??\b`. `IsAbs` did not report paths beginning with `\??\` as absolute. It now does so. VolumeName now reports the `\??\` prefix as a volume name. `Join(`\`, `??`, `b`)` could convert a seemingly innocent sequence of path elements into the root local device path `\??\b`. It will now convert this to `\.\??\b`. This is CVE-2023-45283 and https://go.dev/issue/63713. - path/filepath: recognize device names with trailing spaces and superscripts The `IsLocal` function did not correctly detect reserved names in some cases: - reserved names followed by spaces, such as "COM1 ". - "COM" or "LPT" followed by a superscript 1, 2, or 3. `IsLocal` now correctly reports these names as non-local. This is CVE-2023-45284 and https://go.dev/issue/63713. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/build-test-images.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 2 +- .github/workflows/images.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- Vagrantfile | 2 +- contrib/Dockerfile.test | 2 +- script/setup/prepare_env_windows.ps1 | 2 +- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml index 532777cf5e27..2c8c7e7cd068 100644 --- a/.github/workflows/build-test-images.yml +++ b/.github/workflows/build-test-images.yml @@ -43,7 +43,7 @@ jobs: steps: - uses: actions/setup-go@v3 with: - go-version: "1.20.10" + go-version: "1.20.11" - uses: actions/checkout@v3 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 070813b9ebb2..7cc718189adc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ on: env: # Go version we currently use to build containerd across all CI. # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions. - GO_VERSION: "1.20.10" + GO_VERSION: "1.20.11" permissions: # added using https://github.com/step-security/secure-workflows contents: read @@ -207,7 +207,7 @@ jobs: strategy: matrix: os: [ubuntu-20.04, macos-12, windows-2019, windows-2022] - go-version: ["1.20.10", "1.21.3"] + go-version: ["1.20.11", "1.21.4"] steps: - uses: actions/setup-go@v3 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 02fa14e3ff7a..418af999e806 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/setup-go@v3 with: - go-version: 1.20.10 + go-version: 1.20.11 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index e2ad7bec9120..47d938c7aa6a 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -28,7 +28,7 @@ jobs: steps: - uses: actions/setup-go@v3 with: - go-version: "1.20.10" + go-version: "1.20.11" - uses: actions/checkout@v3 with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index f75defc3bbdd..ae8b816b15c7 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -7,7 +7,7 @@ on: - ".github/workflows/nightly.yml" env: - GO_VERSION: "1.20.10" + GO_VERSION: "1.20.11" permissions: # added using https://github.com/step-security/secure-workflows contents: read diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8c4bbecb08b4..8c15278757d2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ on: name: Release env: - GO_VERSION: "1.20.10" + GO_VERSION: "1.20.11" permissions: # added using https://github.com/step-security/secure-workflows contents: read diff --git a/Vagrantfile b/Vagrantfile index 7b7a3ad07155..d7133c3ae33b 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -102,7 +102,7 @@ EOF config.vm.provision "install-golang", type: "shell", run: "once" do |sh| sh.upload_path = "/tmp/vagrant-install-golang" sh.env = { - 'GO_VERSION': ENV['GO_VERSION'] || "1.20.10", + 'GO_VERSION': ENV['GO_VERSION'] || "1.20.11", } sh.inline = <<~SHELL #!/usr/bin/env bash diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test index cba1a23428c0..dd39ce07387e 100644 --- a/contrib/Dockerfile.test +++ b/contrib/Dockerfile.test @@ -29,7 +29,7 @@ # docker run --privileged containerd-test # ------------------------------------------------------------------------------ -ARG GOLANG_VERSION=1.20.10 +ARG GOLANG_VERSION=1.20.11 ARG GOLANG_IMAGE=golang FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang diff --git a/script/setup/prepare_env_windows.ps1 b/script/setup/prepare_env_windows.ps1 index f4516b461072..c6ea414fea22 100644 --- a/script/setup/prepare_env_windows.ps1 +++ b/script/setup/prepare_env_windows.ps1 @@ -5,7 +5,7 @@ # lived test environment. Set-MpPreference -DisableRealtimeMonitoring:$true -$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.10"; make = ""; nssm = "" } +$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.11"; make = ""; nssm = "" } Write-Host "Downloading chocolatey package" curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip' From 0d314401d9b9ad470153dc3d09f6d9cd7d527697 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 5 Dec 2023 23:40:37 +0100 Subject: [PATCH 2/2] update to go1.20.12, test go1.21.5 go1.20.12 (released 2023-12-05) includes security fixes to the go command, and the net/http and path/filepath packages, as well as bug fixes to the compiler and the go command. See the Go 1.20.12 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.20.12+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.20.11...go1.20.12 from the security mailing: [security] Go 1.21.5 and Go 1.20.12 are released Hello gophers, We have just released Go versions 1.21.5 and 1.20.12, minor point releases. These minor releases include 3 security fixes following the security policy: - net/http: limit chunked data overhead A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Thanks to Bartek Nowotarski for reporting this issue. This is CVE-2023-39326 and Go issue https://go.dev/issue/64433. - cmd/go: go get may unexpectedly fallback to insecure git Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). Thanks to David Leadbeater for reporting this issue. This is CVE-2023-45285 and Go issue https://go.dev/issue/63845. - path/filepath: retain trailing \ when cleaning paths like \\?\c:\ Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?\, resulting in filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other effects). The previous behavior has been restored. This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/build-test-images.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 2 +- .github/workflows/images.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- Vagrantfile | 2 +- contrib/Dockerfile.test | 2 +- script/setup/prepare_env_windows.ps1 | 2 +- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml index 2c8c7e7cd068..29efc5970c15 100644 --- a/.github/workflows/build-test-images.yml +++ b/.github/workflows/build-test-images.yml @@ -43,7 +43,7 @@ jobs: steps: - uses: actions/setup-go@v3 with: - go-version: "1.20.11" + go-version: "1.20.12" - uses: actions/checkout@v3 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7cc718189adc..3bf33966f3ec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ on: env: # Go version we currently use to build containerd across all CI. # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions. - GO_VERSION: "1.20.11" + GO_VERSION: "1.20.12" permissions: # added using https://github.com/step-security/secure-workflows contents: read @@ -207,7 +207,7 @@ jobs: strategy: matrix: os: [ubuntu-20.04, macos-12, windows-2019, windows-2022] - go-version: ["1.20.11", "1.21.4"] + go-version: ["1.20.12", "1.21.5"] steps: - uses: actions/setup-go@v3 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 418af999e806..55da8fccf5dc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -34,7 +34,7 @@ jobs: - uses: actions/setup-go@v3 with: - go-version: 1.20.11 + go-version: 1.20.12 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 47d938c7aa6a..d27dba155a61 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -28,7 +28,7 @@ jobs: steps: - uses: actions/setup-go@v3 with: - go-version: "1.20.11" + go-version: "1.20.12" - uses: actions/checkout@v3 with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index ae8b816b15c7..583cfd2cb93f 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -7,7 +7,7 @@ on: - ".github/workflows/nightly.yml" env: - GO_VERSION: "1.20.11" + GO_VERSION: "1.20.12" permissions: # added using https://github.com/step-security/secure-workflows contents: read diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8c15278757d2..c94a2c718eab 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -13,7 +13,7 @@ on: name: Release env: - GO_VERSION: "1.20.11" + GO_VERSION: "1.20.12" permissions: # added using https://github.com/step-security/secure-workflows contents: read diff --git a/Vagrantfile b/Vagrantfile index d7133c3ae33b..e343d46a42be 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -102,7 +102,7 @@ EOF config.vm.provision "install-golang", type: "shell", run: "once" do |sh| sh.upload_path = "/tmp/vagrant-install-golang" sh.env = { - 'GO_VERSION': ENV['GO_VERSION'] || "1.20.11", + 'GO_VERSION': ENV['GO_VERSION'] || "1.20.12", } sh.inline = <<~SHELL #!/usr/bin/env bash diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test index dd39ce07387e..f5929d53b8b3 100644 --- a/contrib/Dockerfile.test +++ b/contrib/Dockerfile.test @@ -29,7 +29,7 @@ # docker run --privileged containerd-test # ------------------------------------------------------------------------------ -ARG GOLANG_VERSION=1.20.11 +ARG GOLANG_VERSION=1.20.12 ARG GOLANG_IMAGE=golang FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang diff --git a/script/setup/prepare_env_windows.ps1 b/script/setup/prepare_env_windows.ps1 index c6ea414fea22..5b353dab46ed 100644 --- a/script/setup/prepare_env_windows.ps1 +++ b/script/setup/prepare_env_windows.ps1 @@ -5,7 +5,7 @@ # lived test environment. Set-MpPreference -DisableRealtimeMonitoring:$true -$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.11"; make = ""; nssm = "" } +$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.12"; make = ""; nssm = "" } Write-Host "Downloading chocolatey package" curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'