docker-cli

p4u1/docker-cli

Fork 0

Author	SHA1	Message	Date
Sebastiaan van Stijn	1f3e30e1d2	Merge pull request #4696 from thaJeztah/23.0_update_golang_1.20.12 Some checks failed build / prepare (push) Has been cancelled Details build / build (push) Has been cancelled Details build / prepare-plugins (push) Has been cancelled Details build / plugins (push) Has been cancelled Details e2e / e2e (19.03-dind, non-experimental) (push) Has been cancelled Details e2e / e2e (alpine, stable-dind, connhelper-ssh) (push) Has been cancelled Details e2e / e2e (alpine, stable-dind, experimental) (push) Has been cancelled Details e2e / e2e (alpine, stable-dind, non-experimental) (push) Has been cancelled Details e2e / e2e (bullseye, stable-dind, connhelper-ssh) (push) Has been cancelled Details e2e / e2e (bullseye, stable-dind, experimental) (push) Has been cancelled Details e2e / e2e (bullseye, stable-dind, non-experimental) (push) Has been cancelled Details test / ctn (push) Has been cancelled Details test / host (macos-11) (push) Has been cancelled Details validate / validate (lint) (push) Has been cancelled Details validate / validate (shellcheck) (push) Has been cancelled Details validate / validate (update-authors) (push) Has been cancelled Details validate / validate (validate-vendor) (push) Has been cancelled Details validate / validate-md (push) Has been cancelled Details validate / validate-make (manpages) (push) Has been cancelled Details validate / validate-make (yamldocs) (push) Has been cancelled Details [23.0] update to go1.20.12	2023-12-07 18:01:42 +01:00
Sebastiaan van Stijn	3edca7e89d	update to go1.20.12 go1.20.12 (released 2023-12-05) includes security fixes to the go command, and the net/http and path/filepath packages, as well as bug fixes to the compiler and the go command. See the Go 1.20.12 milestone on our issue tracker for details. - https://github.com/golang/go/issues?q=milestone%3AGo1.20.12+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.20.11...go1.20.12 from the security mailing: [security] Go 1.21.5 and Go 1.20.12 are released Hello gophers, We have just released Go versions 1.21.5 and 1.20.12, minor point releases. These minor releases include 3 security fixes following the security policy: - net/http: limit chunked data overhead A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small. Thanks to Bartek Nowotarski for reporting this issue. This is CVE-2023-39326 and Go issue https://go.dev/issue/64433. - cmd/go: go get may unexpectedly fallback to insecure git Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off). Thanks to David Leadbeater for reporting this issue. This is CVE-2023-45285 and Go issue https://go.dev/issue/63845. - path/filepath: retain trailing \ when cleaning paths like \\?\c:\ Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?\, resulting in filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among other effects). The previous behavior has been restored. This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2023-12-06 01:43:07 +01:00
Sebastiaan van Stijn	e505b13caf	update to go1.20.11 go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath package, as well as bug fixes to the linker and the net/http package. See the Go 1.20.11 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.20.11+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.20.10...go1.20.11 from the security mailing: [security] Go 1.21.4 and Go 1.20.11 are released Hello gophers, We have just released Go versions 1.21.4 and 1.20.11, minor point releases. These minor releases include 2 security fixes following the security policy: - path/filepath: recognize `\??\` as a Root Local Device path prefix. On Windows, a path beginning with `\??\` is a Root Local Device path equivalent to a path beginning with `\\?\`. Paths with a `\??\` prefix may be used to access arbitrary locations on the system. For example, the path `\??\c:\x` is equivalent to the more common path c:\x. The filepath package did not recognize paths with a `\??\` prefix as special. Clean could convert a rooted path such as `\a\..\??\b` into the root local device path `\??\b`. It will now convert this path into `.\??\b`. `IsAbs` did not report paths beginning with `\??\` as absolute. It now does so. VolumeName now reports the `\??\` prefix as a volume name. `Join(`\`, `??`, `b`)` could convert a seemingly innocent sequence of path elements into the root local device path `\??\b`. It will now convert this to `\.\??\b`. This is CVE-2023-45283 and https://go.dev/issue/63713. - path/filepath: recognize device names with trailing spaces and superscripts The `IsLocal` function did not correctly detect reserved names in some cases: - reserved names followed by spaces, such as "COM1 ". - "COM" or "LPT" followed by a superscript 1, 2, or 3. `IsLocal` now correctly reports these names as non-local. This is CVE-2023-45284 and https://go.dev/issue/63713. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>	2023-12-06 01:42:38 +01:00

Author

SHA1

Message

Date

Sebastiaan van Stijn

1f3e30e1d2

Merge pull request #4696 from thaJeztah/23.0_update_golang_1.20.12

build / prepare (push) Has been cancelled

Details

build / build (push) Has been cancelled

Details

build / prepare-plugins (push) Has been cancelled

Details

build / plugins (push) Has been cancelled

Details

e2e / e2e (19.03-dind, non-experimental) (push) Has been cancelled

Details

e2e / e2e (alpine, stable-dind, connhelper-ssh) (push) Has been cancelled

Details

e2e / e2e (alpine, stable-dind, experimental) (push) Has been cancelled

Details

e2e / e2e (alpine, stable-dind, non-experimental) (push) Has been cancelled

Details

e2e / e2e (bullseye, stable-dind, connhelper-ssh) (push) Has been cancelled

Details

e2e / e2e (bullseye, stable-dind, experimental) (push) Has been cancelled

Details

e2e / e2e (bullseye, stable-dind, non-experimental) (push) Has been cancelled

Details

test / ctn (push) Has been cancelled

Details

test / host (macos-11) (push) Has been cancelled

Details

validate / validate (lint) (push) Has been cancelled

Details

validate / validate (shellcheck) (push) Has been cancelled

Details

validate / validate (update-authors) (push) Has been cancelled

Details

validate / validate (validate-vendor) (push) Has been cancelled

Details

validate / validate-md (push) Has been cancelled

Details

validate / validate-make (manpages) (push) Has been cancelled

Details

validate / validate-make (yamldocs) (push) Has been cancelled

Details

[23.0] update to go1.20.12

2023-12-07 18:01:42 +01:00

Sebastiaan van Stijn

3edca7e89d

update to go1.20.12

go1.20.12 (released 2023-12-05) includes security fixes to the go command,
and the net/http and path/filepath packages, as well as bug fixes to the
compiler and the go command. See the Go 1.20.12 milestone on our issue
tracker for details.

- https://github.com/golang/go/issues?q=milestone%3AGo1.20.12+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.20.11...go1.20.12

from the security mailing:

[security] Go 1.21.5 and Go 1.20.12 are released

Hello gophers,

We have just released Go versions 1.21.5 and 1.20.12, minor point releases.

These minor releases include 3 security fixes following the security policy:

- net/http: limit chunked data overhead

  A malicious HTTP sender can use chunk extensions to cause a receiver
  reading from a request or response body to read many more bytes from
  the network than are in the body.

  A malicious HTTP client can further exploit this to cause a server to
  automatically read a large amount of data (up to about 1GiB) when a
  handler fails to read the entire body of a request.

  Chunk extensions are a little-used HTTP feature which permit including
  additional metadata in a request or response body sent using the chunked
  encoding. The net/http chunked encoding reader discards this metadata.
  A sender can exploit this by inserting a large metadata segment with
  each byte transferred. The chunk reader now produces an error if the
  ratio of real body to encoded bytes grows too small.

  Thanks to Bartek Nowotarski for reporting this issue.

  This is CVE-2023-39326 and Go issue https://go.dev/issue/64433.

- cmd/go: go get may unexpectedly fallback to insecure git

  Using go get to fetch a module with the ".git" suffix may unexpectedly
  fallback to the insecure "git://" protocol if the module is unavailable
  via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE
  is not set for said module. This only affects users who are not using
  the module proxy and are fetching modules directly (i.e. GOPROXY=off).

  Thanks to David Leadbeater for reporting this issue.

  This is CVE-2023-45285 and Go issue https://go.dev/issue/63845.

- path/filepath: retain trailing \ when cleaning paths like \\?\c:\

  Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the
  volume name in Windows paths starting with \\?\, resulting in
  filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among
  other effects). The previous behavior has been restored.

  This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

2023-12-06 01:43:07 +01:00

Sebastiaan van Stijn

e505b13caf

update to go1.20.11

go1.20.11 (released 2023-11-07) includes security fixes to the path/filepath
package, as well as bug fixes to the linker and the net/http package. See the
Go 1.20.11 milestone on our issue tracker for details:

- https://github.com/golang/go/issues?q=milestone%3AGo1.20.11+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.20.10...go1.20.11

from the security mailing:

[security] Go 1.21.4 and Go 1.20.11 are released

Hello gophers,

We have just released Go versions 1.21.4 and 1.20.11, minor point releases.

These minor releases include 2 security fixes following the security policy:

- path/filepath: recognize `\??\` as a Root Local Device path prefix.

  On Windows, a path beginning with `\??\` is a Root Local Device path equivalent
  to a path beginning with `\\?\`. Paths with a `\??\` prefix may be used to
  access arbitrary locations on the system. For example, the path `\??\c:\x`
  is equivalent to the more common path c:\x.

  The filepath package did not recognize paths with a `\??\` prefix as special.

  Clean could convert a rooted path such as `\a\..\??\b` into
  the root local device path `\??\b`. It will now convert this
  path into `.\??\b`.

  `IsAbs` did not report paths beginning with `\??\` as absolute.
  It now does so.

  VolumeName now reports the `\??\` prefix as a volume name.

  `Join(`\`, `??`, `b`)` could convert a seemingly innocent
  sequence of path elements into the root local device path
  `\??\b`. It will now convert this to `\.\??\b`.

  This is CVE-2023-45283 and https://go.dev/issue/63713.

- path/filepath: recognize device names with trailing spaces and superscripts

  The `IsLocal` function did not correctly detect reserved names in some cases:

  - reserved names followed by spaces, such as "COM1 ".
  - "COM" or "LPT" followed by a superscript 1, 2, or 3.

  `IsLocal` now correctly reports these names as non-local.

  This is CVE-2023-45284 and https://go.dev/issue/63713.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

2023-12-06 01:42:38 +01:00

7 changed files with 7 additions and 7 deletions

									
										2

.github/workflows/test.yml
									
										vendored
									
												View File
												
				@ -63,7 +63,7 @@ jobs:

				        name: Set up Go

				        uses: actions/setup-go@v3

				        with:

				          go-version: 1.20.10

				          go-version: 1.20.12

				      -

				        name: Test

				        run: |

									
										2

Dockerfile
									
												View File
												
				@ -1,7 +1,7 @@

				# syntax=docker/dockerfile:1

				ARG BASE_VARIANT=alpine

				ARG GO_VERSION=1.20.10

				ARG GO_VERSION=1.20.12

				ARG ALPINE_VERSION=3.17

				ARG XX_VERSION=1.1.1

				ARG GOVERSIONINFO_VERSION=v1.3.0

									
										2

docker-bake.hcl
									
												View File
												
				@ -1,5 +1,5 @@

				variable "GO_VERSION" {

				    default = "1.20.10"

				    default = "1.20.12"

				}

				variable "VERSION" {

				    default = ""

									
										2

dockerfiles/Dockerfile.dev
									
												View File
												
				@ -1,6 +1,6 @@

				# syntax=docker/dockerfile:1

				ARG GO_VERSION=1.20.10

				ARG GO_VERSION=1.20.12

				ARG ALPINE_VERSION=3.17

				ARG BUILDX_VERSION=0.11.2

									
										2

dockerfiles/Dockerfile.lint
									
												View File
												
				@ -1,6 +1,6 @@

				# syntax=docker/dockerfile:1

				ARG GO_VERSION=1.20.10

				ARG GO_VERSION=1.20.12

				ARG ALPINE_VERSION=3.17

				ARG GOLANGCI_LINT_VERSION=v1.52.2

									
										2

dockerfiles/Dockerfile.vendor
									
												View File
												
				@ -1,6 +1,6 @@

				# syntax=docker/dockerfile:1

				ARG GO_VERSION=1.20.10

				ARG GO_VERSION=1.20.12

				ARG ALPINE_VERSION=3.17

				ARG MODOUTDATED_VERSION=v0.8.0

									
										2

e2e/testdata/Dockerfile.gencerts
									
										vendored
									
												View File
												
				@ -1,6 +1,6 @@

				# syntax=docker/dockerfile:1

				ARG GO_VERSION=1.20.10

				ARG GO_VERSION=1.20.12

				FROM golang:${GO_VERSION}-alpine AS generated

				RUN go install github.com/dmcgowan/quicktls@master

Compare commits

3 Commits

v23.0.8 ... v23.0.9

2

.github/workflows/test.yml vendored

View File

2

Dockerfile

View File

2

docker-bake.hcl

View File

2

dockerfiles/Dockerfile.dev

View File

2

dockerfiles/Dockerfile.lint

View File

2

dockerfiles/Dockerfile.vendor

View File

2

e2e/testdata/Dockerfile.gencerts vendored

View File

Compare commits

3 Commits v23.0.8 ... v23.0.9

2 .github/workflows/test.yml vendored Unescape Escape View File

2 Dockerfile Unescape Escape View File

2 docker-bake.hcl Unescape Escape View File

2 dockerfiles/Dockerfile.dev Unescape Escape View File

2 dockerfiles/Dockerfile.lint Unescape Escape View File

2 dockerfiles/Dockerfile.vendor Unescape Escape View File

2 e2e/testdata/Dockerfile.gencerts vendored Unescape Escape View File

3 Commits

v23.0.8 ... v23.0.9

2

.github/workflows/test.yml vendored

View File

2

Dockerfile

View File

2

docker-bake.hcl

View File

2

dockerfiles/Dockerfile.dev

View File

2

dockerfiles/Dockerfile.lint

View File

2

dockerfiles/Dockerfile.vendor

View File

2

e2e/testdata/Dockerfile.gencerts vendored

View File