go1.18.3 (released 2022-06-01) includes security fixes to the crypto/rand,
crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the
compiler, and the crypto/tls and text/template/parse packages. See the Go
1.18.3 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.18.3+label%3ACherryPickApproved
Hello gophers,
We have just released Go versions 1.18.3 and 1.17.11, minor point releases.
These minor releases include 4 security fixes following the security policy:
- crypto/rand: rand.Read hangs with extremely large buffers
On Windows, rand.Read will hang indefinitely if passed a buffer larger than
1 << 32 - 1 bytes.
Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset,
for reporting this issue.
This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561.
- crypto/tls: session tickets lack random ticket_age_add
Session tickets generated by crypto/tls did not contain a randomly generated
ticket_age_add. This allows an attacker that can observe TLS handshakes to
correlate successive connections by comparing ticket ages during session
resumption.
Thanks to GitHub user nervuri for reporting this.
This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814.
- `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows
If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput`
are executed when Cmd.Path is unset and, in the working directory, there are
binaries named either "..com" or "..exe", they will be executed.
Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting
this.
This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574.
- `path/filepath`: Clean(`.\c:`) returns `c:` on Windows
On Windows, the `filepath.Clean` function could convert an invalid path to a
valid, absolute path. For example, Clean(`.\c:`) returned `c:`.
Thanks to Unrud for reporting this issue.
This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476.
[CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634
[CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629
[CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580
[CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Bump linter to 1.39.0
* Use dockerfile:1.2 syntax instead of experimental
* Fix typo in GitHub Actions
Signed-off-by: Chris Crone <christopher.crone@docker.com>
Build:
* Golang 1.15.2 to 1.15.3
* golangci-lint 1.31.0 to 1.32.0
* protoc-gen-go 1.4.1 to 1.4.3
All direct Go dependencies except Azure/azure-sdk-for-go which required
code changes.
Signed-off-by: Chris Crone <christopher.crone@docker.com>
* `make` will build the cli with all backends exnabled
* `make cross` will cross build without the example and local backend
You can still cross compile with all backends by doing
```console
$ BUILD_TAGS=example,local make cross
```
Signed-off-by: Djordje Lukic <djordje.lukic@docker.com>
* Use mounts for RUN commands to avoid creating extra layers
* Use built-in platform support
Signed-off-by: Christopher Crone <christopher.crone@docker.com>
This approach allows better caching of results (so faster subsequent
lints). It also avoids bind mounts which are slow.
Benchmarks on my machine (2017 MacBook Pro 13"):
* bind mount lint: 2m 38s
* new lint (after docker builder prune): 1m 35s
* old lint (rerun no changes): 2m 38s
* new lint (rerun added println in random Go file): 9s
Signed-off-by: Christopher Crone <christopher.crone@docker.com>
