go1.11.13 (released 2019/08/13) includes security fixes to the net/http and net/url packages.
See the Go 1.11.13 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.11.13
- net/http: Denial of Service vulnerabilities in the HTTP/2 implementation
net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted
clients could be remotely made to allocate an unlimited amount of memory, until the program
crashes. Servers will now close connections if the send queue accumulates too many control
messages.
The issues are CVE-2019-9512 and CVE-2019-9514, and Go issue golang.org/issue/33606.
Thanks to Jonathan Looney from Netflix for discovering and reporting these issues.
This is also fixed in version v0.0.0-20190813141303-74dc4d7220e7 of golang.org/x/net/http2.
net/url: parsing validation issue
- url.Parse would accept URLs with malformed hosts, such that the Host field could have arbitrary
suffixes that would appear in neither Hostname() nor Port(), allowing authorization bypasses
in certain applications. Note that URLs with invalid, not numeric ports will now return an error
from url.Parse.
The issue is CVE-2019-14809 and Go issue golang.org/issue/29098.
Thanks to Julian Hector and Nikolai Krein from Cure53, and Adi Cohen (adico.me) for discovering
and reporting this issue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 9a7c1a1e5f0858ac54f1c7577c4fca8665f70496
Component: packaging
go1.11.11 (released 2019/06/11) includes a fix to the crypto/x509 package.
See the Go 1.11.11 milestone on the issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.11.11
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: f33c398df1eabda69ca05ff6c5c45351790a8696
Component: packaging
go1.11.3 (released 2018/12/14)
- crypto/x509: CPU denial of service in chain validation golang/go#29233
- cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231
- cmd/go: remote command execution during "go get -u" golang/go#29230
See the Go 1.11.3 milestone on the issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.11.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 517a30b48d7b483e27eb3c3328356a8e83272988)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 17565b93d361b1b189962b3e98c431316a7cc628
Component: packaging
Includes fixes to the go command, linker, and the net/http, mime/multipart,
ld/macho, bytes, and strings packages. See the Go 1.10.4 milestone on the
issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.10.4
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 11b4630f4c73885123336b7917cc139c43cf413a)
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Upstream-commit: 3920ea81ea2cab8e1f5f17fb16e133cfb87d9c98
Component: packaging
This encodes the platform as "Docker Engine - Community"
for community engines
Signed-off-by: Daniel Hiltgen <daniel.hiltgen@docker.com>
Upstream-commit: 4d9fd7d17f3aab3463baf6030072f5789a003a74
Component: packaging
go1.10.3 (released 2018/06/05) includes fixes to the go command, and the
crypto/tls, crypto/x509, and strings packages. In particular, it adds minimal
support to the go command for the vgo transition. See the Go 1.10.3 milestone
on our issue tracker for details;
https://github.com/golang/go/issues?q=milestone%3AGo1.10.3
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Upstream-commit: 65fc4f1c0cc81739df97605f1fbf91dbf2e7739f
Component: packaging
Use a variable in the Makefile to set the GO_VERSION for the builds.
GO_VERSION is defaulted in all Makefiles as `1.10.2`, but can be set when running make: `make GO_VERSION=1.10.1 deb`.
Signed-off-by: corbin-coleman <corbin.coleman@docker.com>
Upstream-commit: 0fe741746287335a5ba4afaf06be301915324e5a
Component: packaging
The hardcoded values make it so that we have to update this everytime we
add/subtract something which is sometimes followed/not followed.
This makes it so that we no longer have to update this.
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Upstream-commit: 04ec3b020edc79830c5a0100790f5bb6686d8efc
Component: packaging
Zesty is EOL and doesn't even have a subdirectory in the `deb` directory of this repo. There's no need to have it as a default.
Signed-off-by: Corbin <corbin.coleman@docker.com>
Upstream-commit: 9b3e8f85f039dfe7391512de6143ef213574973a
Component: packaging
Was getting annoying to have to write it into one spot so moved them to
above the targets that they specify.
Signed-off-by: Eli Uriegas <seemethere101@gmail.com>
Upstream-commit: a8e527df5d6579cc53372c26ef86fdcf449aa9ae
Component: packaging
When building we should default to a dummy version unless otherwise
specified so we don't get ourselves confused over what is official and
what is not.
Signed-off-by: Eli Uriegas <eli.uriegas@docker.com>
Upstream-commit: ffcd040b5c3bd4f81e1d1f11c32f9bb81e235ed1
Component: packaging
Sebastiaan van Stijn
Kir Kolyshkin
Eli Uriegas
Andrew Hsu
Daniel Hiltgen
Jose Bigio
corbin-coleman
Eli Uriegas
Stefan Scherer
Roberto Gandolfo Hashioka