diff options
| author | Sebastiaan van Stijn <github@gone.nl> | 2022-09-06 22:33:13 +0200 |
|---|---|---|
| committer | Cory Snider <csnider@mirantis.com> | 2023-02-27 11:28:45 -0500 |
| commit | 6cc1ef32a28e7e6e74383d4775bd178d36495181 (patch) | |
| tree | ac7130aff61c8f3de467b6417b418447474387fc | |
| parent | 721358e0cb7c10b41508f3c114baeceb2ac9ba0a (diff) | |
| download | docker-6cc1ef32a28e7e6e74383d4775bd178d36495181.tar.gz | |
Update to go 1.19.1 to address CVE-2022-27664, CVE-2022-32190
From the mailing list:
We have just released Go versions 1.19.1 and 1.18.6, minor point releases.
These minor releases include 2 security fixes following the security policy:
- net/http: handle server errors after sending GOAWAY
A closing HTTP/2 server connection could hang forever waiting for a clean
shutdown that was preempted by a subsequent fatal error. This failure mode
could be exploited to cause a denial of service.
Thanks to Bahruz Jabiyev, Tommaso Innocenti, Anthony Gavazzi, Steven Sprecher,
and Kaan Onarlioglu for reporting this.
This is CVE-2022-27664 and Go issue https://go.dev/issue/54658.
- net/url: JoinPath does not strip relative path components in all circumstances
JoinPath and URL.JoinPath would not remove `../` path components appended to a
relative path. For example, `JoinPath("https://go.dev", "../go")` returned the
URL `https://go.dev/../go`, despite the JoinPath documentation stating that
`../` path elements are cleaned from the result.
Thanks to q0jt for reporting this issue.
This is CVE-2022-32190 and Go issue https://go.dev/issue/54385.
Release notes:
go1.19.1 (released 2022-09-06) includes security fixes to the net/http and
net/url packages, as well as bug fixes to the compiler, the go command, the pprof
command, the linker, the runtime, and the crypto/tls and crypto/x509 packages.
See the Go 1.19.1 milestone on the issue tracker for details.
https://github.com/golang/go/issues?q=milestone%3AGo1.19.1+label%3ACherryPickApproved
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 1eadbdd9fadca31c02b6f0aebfbbab4d8c6cf716)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| -rw-r--r-- | Dockerfile | 2 | ||||
| -rw-r--r-- | Dockerfile.e2e | 2 | ||||
| -rw-r--r-- | Dockerfile.simple | 2 | ||||
| -rw-r--r-- | Dockerfile.windows | 2 |
4 files changed, 4 insertions, 4 deletions
diff --git a/Dockerfile b/Dockerfile index 6fa4b7af1f..af8064a976 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ ARG CROSS="false" ARG SYSTEMD="false" # IMPORTANT: When updating this please note that stdlib archive/tar pkg is vendored -ARG GO_VERSION=1.19 +ARG GO_VERSION=1.19.1 ARG DEBIAN_FRONTEND=noninteractive ARG VPNKIT_VERSION=0.5.0 ARG DOCKER_BUILDTAGS="apparmor seccomp" diff --git a/Dockerfile.e2e b/Dockerfile.e2e index d7f02edc1c..a278741006 100644 --- a/Dockerfile.e2e +++ b/Dockerfile.e2e @@ -1,4 +1,4 @@ -ARG GO_VERSION=1.19 +ARG GO_VERSION=1.19.1 FROM golang:${GO_VERSION}-alpine AS base ENV GO111MODULE=off diff --git a/Dockerfile.simple b/Dockerfile.simple index 305515a5b0..4c4fc50898 100644 --- a/Dockerfile.simple +++ b/Dockerfile.simple @@ -5,7 +5,7 @@ # This represents the bare minimum required to build and test Docker. -ARG GO_VERSION=1.19 +ARG GO_VERSION=1.19.1 FROM golang:${GO_VERSION}-buster ENV GO111MODULE=off diff --git a/Dockerfile.windows b/Dockerfile.windows index 10ef4194bb..f0f2c2f6ca 100644 --- a/Dockerfile.windows +++ b/Dockerfile.windows @@ -165,7 +165,7 @@ FROM microsoft/windowsservercore # Use PowerShell as the default shell SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"] -ARG GO_VERSION=1.19 +ARG GO_VERSION=1.19.1 ARG GOTESTSUM_VERSION=v1.8.2 # Environment variable notes: |