From 54f2b51215be6317a632579d225fdca60e8823f8 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 4 Oct 2022 20:58:06 +0200 Subject: [PATCH] Update to go 1.19.2 to address CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 From the mailing list: We have just released Go versions 1.19.2 and 1.18.7, minor point releases. These minor releases include 3 security fixes following the security policy: - archive/tar: unbounded memory consumption when reading headers Reader.Read did not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. Reader.Read now limits the maximum size of header blocks to 1 MiB. Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting this issue. This is CVE-2022-2879 and Go issue https://go.dev/issue/54853. - net/http/httputil: ReverseProxy should not forward unparseable query parameters Requests forwarded by ReverseProxy included the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. ReverseProxy will now sanitize the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy.Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged. Thanks to Gal Goldstein (Security Researcher, Oxeye) and Daniel Abeles (Head of Research, Oxeye) for reporting this issue. This is CVE-2022-2880 and Go issue https://go.dev/issue/54663. - regexp/syntax: limit memory used by parsing regexps The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. Each regexp being parsed is now limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are now rejected. Normal use of regular expressions is unaffected. Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting this issue. This is CVE-2022-41715 and Go issue https://go.dev/issue/55949. View the release notes for more information: https://go.dev/doc/devel/release#go1.19.2 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/build-test-images.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 2 +- .github/workflows/images.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- Vagrantfile | 2 +- contrib/Dockerfile.test | 2 +- contrib/fuzz/oss_fuzz_build.sh | 4 ++-- script/setup/prepare_env_windows.ps1 | 2 +- 10 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml index 9022ac02f..c66ff3e35 100644 --- a/.github/workflows/build-test-images.yml +++ b/.github/workflows/build-test-images.yml @@ -39,7 +39,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.19.1' + go-version: '1.19.2' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3bd6553ef..d1fc583cb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,7 +12,7 @@ on: env: # Go version we currently use to build containerd across all CI. # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions. - GO_VERSION: "1.19.1" + GO_VERSION: "1.19.2" jobs: # @@ -219,7 +219,7 @@ jobs: strategy: matrix: os: [ubuntu-18.04, macos-12, windows-2019, windows-2022] - go-version: ["1.19.1", "1.18.6"] + go-version: ["1.19.2", "1.18.7"] steps: - uses: actions/setup-go@v2 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e828a392d..1bb28471a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/setup-go@v2 with: - go-version: 1.19.1 + go-version: 1.19.2 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml index 1f6ccdb6f..4ef4bf703 100644 --- a/.github/workflows/images.yml +++ b/.github/workflows/images.yml @@ -24,7 +24,7 @@ jobs: steps: - uses: actions/setup-go@v2 with: - go-version: '1.19.1' + go-version: '1.19.2' - uses: actions/checkout@v2 with: diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 9b0d1d76b..5f80c729e 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -7,7 +7,7 @@ on: - '.github/workflows/nightly.yml' env: - GO_VERSION: '1.19.1' + GO_VERSION: '1.19.2' jobs: linux: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 122ff95fc..72eb5acf0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,7 +6,7 @@ on: name: Containerd Release env: - GO_VERSION: '1.19.1' + GO_VERSION: '1.19.2' jobs: check: diff --git a/Vagrantfile b/Vagrantfile index d802b4cdb..c29957da2 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -97,7 +97,7 @@ EOF config.vm.provision "install-golang", type: "shell", run: "once" do |sh| sh.upload_path = "/tmp/vagrant-install-golang" sh.env = { - 'GO_VERSION': ENV['GO_VERSION'] || "1.19.1", + 'GO_VERSION': ENV['GO_VERSION'] || "1.19.2", } sh.inline = <<~SHELL #!/usr/bin/env bash diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test index 6a6b3dff7..22a35a5e5 100644 --- a/contrib/Dockerfile.test +++ b/contrib/Dockerfile.test @@ -10,7 +10,7 @@ # # docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../ -ARG GOLANG_VERSION=1.19.1 +ARG GOLANG_VERSION=1.19.2 ARG GOLANG_IMAGE=golang FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang diff --git a/contrib/fuzz/oss_fuzz_build.sh b/contrib/fuzz/oss_fuzz_build.sh index 84fdf0263..2208b9049 100755 --- a/contrib/fuzz/oss_fuzz_build.sh +++ b/contrib/fuzz/oss_fuzz_build.sh @@ -44,11 +44,11 @@ go run main.go $SRC/containerd/images apt-get update && apt-get install -y wget cd $SRC -wget --quiet https://go.dev/dl/go1.19.1.linux-amd64.tar.gz +wget --quiet https://go.dev/dl/go1.19.2.linux-amd64.tar.gz mkdir temp-go rm -rf /root/.go/* -tar -C temp-go/ -xzf go1.19.1.linux-amd64.tar.gz +tar -C temp-go/ -xzf go1.19.2.linux-amd64.tar.gz mv temp-go/go/* /root/.go/ cd $SRC/containerd diff --git a/script/setup/prepare_env_windows.ps1 b/script/setup/prepare_env_windows.ps1 index 0561afcd7..b8ee1304b 100644 --- a/script/setup/prepare_env_windows.ps1 +++ b/script/setup/prepare_env_windows.ps1 @@ -5,7 +5,7 @@ # lived test environment. Set-MpPreference -DisableRealtimeMonitoring:$true -$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.19.1"; make = ""; nssm = "" } +$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.19.2"; make = ""; nssm = "" } Write-Host "Downloading chocolatey package" curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'