From 1b3c3860db5093e7a2fa7967c746c48c70d7ecd5 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 2 Jun 2022 09:45:19 +0200 Subject: [PATCH] update golang to 1.18.3, 1.17.11 go1.18.3 (released 2022-06-01) includes security fixes to the crypto/rand, crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the compiler, and the crypto/tls and text/template/parse packages. See the Go 1.18.3 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.18.3+label%3ACherryPickApproved update golang to 1.17.11 go1.17.11 (released 2022-06-01) includes security fixes to the crypto/rand, crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the crypto/tls package. See the Go 1.17.11 milestone on our issue tracker for details. https://github.com/golang/go/issues?q=milestone%3AGo1.17.11+label%3ACherryPickApproved Hello gophers, We have just released Go versions 1.18.3 and 1.17.11, minor point releases. These minor releases include 4 security fixes following the security policy: - crypto/rand: rand.Read hangs with extremely large buffers On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 << 32 - 1 bytes. Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset, for reporting this issue. This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561. - crypto/tls: session tickets lack random ticket_age_add Session tickets generated by crypto/tls did not contain a randomly generated ticket_age_add. This allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. Thanks to GitHub user nervuri for reporting this. This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814. - `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput` are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed. Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting this. This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574. - `path/filepath`: Clean(`.\c:`) returns `c:` on Windows On Windows, the `filepath.Clean` function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. Thanks to Unrud for reporting this issue. This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476. [CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634 [CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629 [CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580 [CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/build-test-images.yml | 2 +- .github/workflows/ci.yml | 18 +++++++++--------- .github/workflows/codeql.yml | 2 +- .github/workflows/images.yml | 2 +- .github/workflows/nightly.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .../containerd-build/integration-test.yaml | 2 +- .zuul/playbooks/containerd-build/run.yaml | 2 +- .../playbooks/containerd-build/unit-test.yaml | 2 +- Vagrantfile | 2 +- contrib/Dockerfile.test | 2 +- contrib/fuzz/oss_fuzz_build.sh | 4 ++-- 12 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml index 53f960da6..fa41b3508 100644 --- a/.github/workflows/build-test-images.yml +++ b/.github/workflows/build-test-images.yml @@ -39,7 +39,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5ff15a6d9..2418a4c44 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: strategy: matrix: - go-version: [1.18.2] + go-version: [1.18.3] os: [ubuntu-18.04, macos-10.15, windows-2019] steps: @@ -46,7 +46,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 with: @@ -78,7 +78,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 with: @@ -110,7 +110,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 - run: go install github.com/cpuguy83/go-md2man/v2@v2.0.1 - run: make man @@ -148,7 +148,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 - run: | set -e -x @@ -215,7 +215,7 @@ jobs: strategy: matrix: os: [ubuntu-18.04, macos-10.15, windows-2019, windows-2022] - go-version: ['1.17.10', '1.18.2'] + go-version: ['1.17.11', '1.18.3'] steps: - uses: actions/setup-go@v2 with: @@ -261,7 +261,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 with: @@ -389,7 +389,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 @@ -508,7 +508,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 - run: sudo -E PATH=$PATH script/setup/install-gotestsum - name: Tests diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4dae42fef..aaeb38128 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/setup-go@v2 with: - go-version: 1.18.2 + go-version: 1.18.3 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 94a6f1d1a..1ca92baf0 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -24,7 +24,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index d3e6846f8..6577d40ad 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -18,7 +18,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 with: @@ -155,7 +155,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ddc2528e7..5b77e01b0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -66,7 +66,7 @@ jobs: - name: Install Go uses: actions/setup-go@v2 with: - go-version: '1.18.2' + go-version: '1.18.3' - name: Set env shell: bash env: @@ -109,7 +109,7 @@ jobs: find ./releases/ -maxdepth 1 -type l | xargs rm working-directory: src/github.com/containerd/containerd env: - GO_VERSION: '1.18.2' + GO_VERSION: '1.18.3' PLATFORM: ${{ matrix.platform }} - name: Save Artifacts uses: actions/upload-artifact@v2 diff --git a/.zuul/playbooks/containerd-build/integration-test.yaml b/.zuul/playbooks/containerd-build/integration-test.yaml index 4f1024fc7..dc983f3d2 100644 --- a/.zuul/playbooks/containerd-build/integration-test.yaml +++ b/.zuul/playbooks/containerd-build/integration-test.yaml @@ -2,7 +2,7 @@ become: yes roles: - role: config-golang - go_version: '1.18.2' + go_version: '1.18.3' arch: arm64 tasks: - name: Install pre-requisites diff --git a/.zuul/playbooks/containerd-build/run.yaml b/.zuul/playbooks/containerd-build/run.yaml index 577b029db..5a7229ed2 100644 --- a/.zuul/playbooks/containerd-build/run.yaml +++ b/.zuul/playbooks/containerd-build/run.yaml @@ -2,7 +2,7 @@ become: yes roles: - role: config-golang - go_version: '1.18.2' + go_version: '1.18.3' arch: arm64 tasks: - name: Build containerd diff --git a/.zuul/playbooks/containerd-build/unit-test.yaml b/.zuul/playbooks/containerd-build/unit-test.yaml index 41ac82739..e42f1e85d 100644 --- a/.zuul/playbooks/containerd-build/unit-test.yaml +++ b/.zuul/playbooks/containerd-build/unit-test.yaml @@ -2,7 +2,7 @@ become: yes roles: - role: config-golang - go_version: '1.18.2' + go_version: '1.18.3' arch: arm64 tasks: - name: Build and test containerd diff --git a/Vagrantfile b/Vagrantfile index e9b73994e..73b7fb76b 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -97,7 +97,7 @@ EOF config.vm.provision "install-golang", type: "shell", run: "once" do |sh| sh.upload_path = "/tmp/vagrant-install-golang" sh.env = { - 'GO_VERSION': ENV['GO_VERSION'] || "1.18.2", + 'GO_VERSION': ENV['GO_VERSION'] || "1.18.3", } sh.inline = <<~SHELL #!/usr/bin/env bash diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test index 35c7b57e8..5d8c8b780 100644 --- a/contrib/Dockerfile.test +++ b/contrib/Dockerfile.test @@ -10,7 +10,7 @@ # # docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../ -ARG GOLANG_VERSION=1.18.2 +ARG GOLANG_VERSION=1.18.3 ARG GOLANG_IMAGE=golang FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang diff --git a/contrib/fuzz/oss_fuzz_build.sh b/contrib/fuzz/oss_fuzz_build.sh index 0af0f4e61..8257bbfcf 100755 --- a/contrib/fuzz/oss_fuzz_build.sh +++ b/contrib/fuzz/oss_fuzz_build.sh @@ -20,11 +20,11 @@ set -x apt-get update && apt-get install -y wget cd $SRC -wget https://go.dev/dl/go1.18.2.linux-amd64.tar.gz +wget https://go.dev/dl/go1.18.3.linux-amd64.tar.gz mkdir temp-go rm -rf /root/.go/* -tar -C temp-go/ -xzf go1.18.2.linux-amd64.tar.gz +tar -C temp-go/ -xzf go1.18.3.linux-amd64.tar.gz mv temp-go/go/* /root/.go/ cd $SRC/containerd