64413c20ef
full diff: https://github.com/golang/go/compare/go1.23.7...go1.23.8 release notes: https://go.dev/doc/devel/release#go1.24.2 go1.23.8 (released 2025-04-01) includes security fixes to the net/http package, as well as bug fixes to the runtime and the go command. See the Go 1.23.8 milestone on our issue tracker for details; https://github.com/golang/go/issues?q=milestone%3AGo1.23.8+label%3ACherryPickApproved From the mailing list: Hello gophers, We have just released Go versions 1.24.2 and 1.23.8, minor point releases. These minor releases include 1 security fixes following the security policy: - net/http: request smuggling through invalid chunked data The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. The net/http package now rejects chunk-size lines containing a bare LF. Thanks to Jeppe Bonde Weikop for reporting this issue. This is CVE-2025-22871 and Go issue https://go.dev/issue/71988. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
21 lines
669 B
Docker
21 lines
669 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
ARG GO_VERSION=1.23.8
|
|
|
|
FROM golang:${GO_VERSION}-alpine AS generated
|
|
ENV GOTOOLCHAIN=local
|
|
RUN go install github.com/dmcgowan/quicktls@master
|
|
WORKDIR /tmp/gencerts/notary
|
|
RUN --mount=type=bind,source=e2e/testdata/notary,target=/tmp/gencerts/notary,rw <<EOT
|
|
set -eu
|
|
mkdir -p ../notary-evil /out
|
|
quicktls -exp 87600h -org=Docker -with-san notary-server notaryserver evil-notary-server evilnotaryserver localhost 127.0.0.1
|
|
cat ca.pem >> notary-server.cert
|
|
mv ca.pem root-ca.cert
|
|
cp notary-server.cert notary-server.key root-ca.cert ../notary-evil
|
|
cp -r /tmp/gencerts/notary* /out/
|
|
EOT
|
|
|
|
FROM scratch
|
|
COPY --from=generated /out /
|