Bump Golang 1.13.3 (CVE-2019-17596) by tao12345666333 · Pull Request #40102 · moby/moby

tao12345666333 · 2019-10-18T02:27:23Z

Signed-off-by: Jintao Zhang zhangjintao9020@gmail.com

- What I did

Full diff golang/go@go1.13.1...go1.13.3

For Golang 1.13.2: (CVE-2019-17596)

Hi gophers,

We have just released Go 1.13.2 and Go 1.12.11 to address a recently reported security issue. We recommend that all affected users update to one of these releases (if you’re not sure which, choose Go 1.13.2).

Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don’t chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected.

Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key.

The issue is CVE-2019-17596 and Go issue golang.org/issue/34960.

Thanks to Daniel Mandragona for discovering and reporting this issue. We’d also like to thank regilero for a previous disclosure of CVE-2019-16276.

The Go 1.13.2 release also includes a fix to the compiler that prevents improper access to negative slice indexes in rare cases. Affected code, in which the compiler can prove that the index is zero or negative, would have resulted in a panic in Go 1.12, but could have led to arbitrary memory read and writes in Go 1.13 and Go 1.13.1. This is Go issue golang.org/issue/34802.

For Golang 1.13.3:

Hello gophers,

We have just released Go versions 1.13.3 and 1.12.12, minor point releases.

These releases include fixes to the go command, the toolchain, the runtime,
syscall, net, net/http, and crypto/ecdsa packages.

View the release notes for more information:
    https://golang.org/doc/devel/release.html#go1.13.minor

You can download the binary and source distributions from the Go website:
    https://golang.org/dl/

To compile from source using a Git clone, update to the release with
"git checkout go1.13.3" and build as usual.

Thanks to everyone who contributed to the release.

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>

tao12345666333 · 2019-10-18T02:28:15Z

Wait for Golang docker image has been published. docker-library/official-images#6805

tao12345666333 · 2019-10-18T08:44:07Z

The golang 1.13.3 docker image has been published.

Jobs need re-build.

tao12345666333 · 2019-10-18T13:18:36Z

@thaJeztah PTAL Thanks.

thaJeztah

LGTM if green, thanks!

restarted the build

cpuguy83

LGTM

full diff: moby/moby@b6684a4...a30990b relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix. This is to ensure that users of the homedir package cannot compile statically (`CGO_ENABLED=0`) without also setting the `osusergo` build tag. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: moby/moby@b6684a4...a30990b relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix. This is to ensure that users of the homedir package cannot compile statically (`CGO_ENABLED=0`) without also setting the `osusergo` build tag. - moby/moby#39983 builder: remove legacy build's session handling This feature was used by docker build --stream and it was kept experimental. Users of this endpoint should enable BuildKit anyway by setting Version to BuilderBuildKit. - Related: docker#2105 build: remove --stream (was experimental) - moby/moby #40045 Bump logrus 1.4.2, go-shellwords, mergo, flock, creack/pty, golang/gddo, gorilla/mux - moby/moby#39713 bump containerd and dependencies to v1.3.0 - moby/moby#39987 Add ability to handle index acknowledgment with splunk log driver - moby/moby#40070 Use ocischema package instead of custom handler - relates to moby/moby#39727 Docker 19.03 doesn't support OCI image - relates to docker/hub-feedback#1871 - relates to distribution/distribution#3024 - moby/moby#39231 Add support for sending down service Running and Desired task counts - moby/moby#39822 daemon: Use short libnetwork ID in exec-root Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: moby/moby@b6684a4...a09e6e3 relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#40134 Revert "homedir: add cgo or osusergo buildtag constraints for unix" - reverts moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix, in favor of documenting when to set the `osusergo` build tag. The `osusergo` build-flag must be used when compiling a static binary with `cgo` enabled, and linking against `glibc`. - moby/moby#39983 builder: remove legacy build's session handling This feature was used by docker build --stream and it was kept experimental. Users of this endpoint should enable BuildKit anyway by setting Version to BuilderBuildKit. - Related: docker#2105 build: remove --stream (was experimental) - moby/moby #40045 Bump logrus 1.4.2, go-shellwords, mergo, flock, creack/pty, golang/gddo, gorilla/mux - moby/moby#39713 bump containerd and dependencies to v1.3.0 - moby/moby#39987 Add ability to handle index acknowledgment with splunk log driver - moby/moby#40070 Use ocischema package instead of custom handler - relates to moby/moby#39727 Docker 19.03 doesn't support OCI image - relates to docker/hub-feedback#1871 - relates to distribution/distribution#3024 - moby/moby#39231 Add support for sending down service Running and Desired task counts - moby/moby#39822 daemon: Use short libnetwork ID in exec-root - moby/moby#39100 Use Microsoft/hcsshim constants and deprecate pkg/system.GetOsVersion() - updates/requires Microsoft/hscshim@2226e083fc390003ae5aa8325c3c92789afa0e7a Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

full diff: moby/moby@b6684a4...a09e6e3 relevant changes: - moby/moby#39995 Update containerd binary to v1.2.10 - moby/moby#40001 Update runc to v1.0.0-rc8-92-g84373aaa (CVE-2019-16884) - moby/moby#39999 bump golang 1.13.1 (CVE-2019-16276) - moby/moby#40102 bump golang 1.13.3 (CVE-2019-17596) - moby/moby#40134 Revert "homedir: add cgo or osusergo buildtag constraints for unix" - reverts moby/moby#39994 homedir: add cgo or osusergo buildtag constraints for unix, in favor of documenting when to set the `osusergo` build tag. The `osusergo` build-flag must be used when compiling a static binary with `cgo` enabled, and linking against `glibc`. - moby/moby#39983 builder: remove legacy build's session handling This feature was used by docker build --stream and it was kept experimental. Users of this endpoint should enable BuildKit anyway by setting Version to BuilderBuildKit. - Related: #2105 build: remove --stream (was experimental) - moby/moby #40045 Bump logrus 1.4.2, go-shellwords, mergo, flock, creack/pty, golang/gddo, gorilla/mux - moby/moby#39713 bump containerd and dependencies to v1.3.0 - moby/moby#39987 Add ability to handle index acknowledgment with splunk log driver - moby/moby#40070 Use ocischema package instead of custom handler - relates to moby/moby#39727 Docker 19.03 doesn't support OCI image - relates to docker/hub-feedback#1871 - relates to distribution/distribution#3024 - moby/moby#39231 Add support for sending down service Running and Desired task counts - moby/moby#39822 daemon: Use short libnetwork ID in exec-root - moby/moby#39100 Use Microsoft/hcsshim constants and deprecate pkg/system.GetOsVersion() - updates/requires Microsoft/hscshim@2226e083fc390003ae5aa8325c3c92789afa0e7a Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Upstream-commit: 7f6cd64335dc631efaa8204c01f92aa40939073a Component: cli

Bump Golang 1.13.3 (CVE-2019-17596)

6355842

Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>

thaJeztah added impact/changelog status/2-code-review labels Oct 18, 2019

thaJeztah approved these changes Oct 18, 2019

View reviewed changes

cpuguy83 approved these changes Oct 18, 2019

View reviewed changes

cpuguy83 merged commit 5b18763 into moby:master Oct 18, 2019

tao12345666333 deleted the update-golang-1.13.3 branch October 18, 2019 23:57

thaJeztah mentioned this pull request Oct 23, 2019

Services: use ServiceStatus on API v1.41 and up docker/cli#2157

Merged

4 tasks

thaJeztah mentioned this pull request Oct 24, 2019

bump docker/docker to a09e6e323e55e1a9b21df9c2c555f5668df3ac9b docker/cli#2158

Merged

3 tasks

thaJeztah mentioned this pull request Feb 27, 2020

[19.03 backport] Update Golang 1.13.9 #40592

Merged

thaJeztah added this to the 20.03.0 milestone Apr 2, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump Golang 1.13.3 (CVE-2019-17596)#40102

Bump Golang 1.13.3 (CVE-2019-17596)#40102
cpuguy83 merged 1 commit intomoby:masterfrom
tao12345666333:update-golang-1.13.3

tao12345666333 commented Oct 18, 2019

Uh oh!

tao12345666333 commented Oct 18, 2019

Uh oh!

tao12345666333 commented Oct 18, 2019

Uh oh!

tao12345666333 commented Oct 18, 2019

Uh oh!

thaJeztah left a comment

Uh oh!

cpuguy83 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

tao12345666333 commented Oct 18, 2019

Uh oh!

tao12345666333 commented Oct 18, 2019

Uh oh!

tao12345666333 commented Oct 18, 2019

Uh oh!

tao12345666333 commented Oct 18, 2019

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

cpuguy83 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants