diff options
author | bsiegert <bsiegert@pkgsrc.org> | 2022-06-02 18:50:40 +0000 |
---|---|---|
committer | bsiegert <bsiegert@pkgsrc.org> | 2022-06-02 18:50:40 +0000 |
commit | fb6a085f532f79afecae4398a8ca62056ee3f0bc (patch) | |
tree | 36248e81430dcbafd1c7131b530d63c483fb6da2 /lang | |
parent | 3ca9ce7bd5a62af4ecb7fbee914b3e235f6312f0 (diff) | |
download | pkgsrc-fb6a085f532f79afecae4398a8ca62056ee3f0bc.tar.gz |
Update go118 to 1.18.3
This minor release includes 4 security fixes following the security policy
<https://go.dev/security>:
- crypto/rand: rand.Read hangs with extremely large buffers
On Windows, rand.Read will hang indefinitely if passed a buffer larger
than 1 << 32 - 1 bytes.
Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go
toolset, for reporting this issue.
This is CVE-2022-30634 and Go issue https://go.dev/issue/52561.
- crypto/tls: session tickets lack random ticket_age_add
Session tickets generated by crypto/tls did not contain a randomly
generated ticket_age_add. This allows an attacker that can observe TLS
handshakes to correlate successive connections by comparing ticket ages
during session resumption.
Thanks to GitHub user @nervuri for reporting this.
This is CVE-2022-30629 and Go issue https://go.dev/issue/52814.
- os/exec: empty Cmd.Path can result in running unintended binary on
Windows
If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput
are executed when Cmd.Path is unset and, in the working directory, there
are binaries named either "..com" or "..exe", they will be executed.
Thanks to Chris Darroch (chrisd8088@github.com), brian m. carlson (
bk2204@github.com), and Mikhail Shcherbakov (https://twitter.com/yu5k3)
for reporting this.
This is CVE-2022-30580 and Go issue https://go.dev/issue/52574.
- path/filepath: Clean(`.\c:`) returns `c:` on Windows
On Windows, the filepath.Clean function could convert an invalid path to
a valid, absolute path. For example, Clean(`.\c:`) returned `c:`.
Thanks to Unrud for reporting this issue.
This is CVE-2022-29804 and Go issue https://go.dev/issue/52476.
Diffstat (limited to 'lang')
-rw-r--r-- | lang/go/version.mk | 4 | ||||
-rw-r--r-- | lang/go118/PLIST | 7 | ||||
-rw-r--r-- | lang/go118/distinfo | 8 |
3 files changed, 12 insertions, 7 deletions
diff --git a/lang/go/version.mk b/lang/go/version.mk index 6f9fa727412..48c310c6c99 100644 --- a/lang/go/version.mk +++ b/lang/go/version.mk @@ -1,4 +1,4 @@ -# $NetBSD: version.mk,v 1.150 2022/06/02 18:19:26 bsiegert Exp $ +# $NetBSD: version.mk,v 1.151 2022/06/02 18:50:40 bsiegert Exp $ # # If bsd.prefs.mk is included before go-package.mk in a package, then this @@ -6,7 +6,7 @@ # .include "go-vars.mk" -GO118_VERSION= 1.18.2 +GO118_VERSION= 1.18.3 GO117_VERSION= 1.17.11 GO116_VERSION= 1.16.15 GO110_VERSION= 1.10.8 diff --git a/lang/go118/PLIST b/lang/go118/PLIST index 110b7e49a8a..663a1671af3 100644 --- a/lang/go118/PLIST +++ b/lang/go118/PLIST @@ -1,4 +1,4 @@ -@comment $NetBSD: PLIST,v 1.3 2022/05/11 19:00:55 bsiegert Exp $ +@comment $NetBSD: PLIST,v 1.4 2022/06/02 18:50:40 bsiegert Exp $ bin/go${GOVERSSUFFIX} bin/gofmt${GOVERSSUFFIX} go118/AUTHORS @@ -10772,6 +10772,9 @@ go118/test/fixedbugs/issue51531.go go118/test/fixedbugs/issue5162.go go118/test/fixedbugs/issue5172.go go118/test/fixedbugs/issue51839.go +go118/test/fixedbugs/issue52279.dir/lib.go +go118/test/fixedbugs/issue52279.dir/main.go +go118/test/fixedbugs/issue52279.go go118/test/fixedbugs/issue5231.go go118/test/fixedbugs/issue52438.go go118/test/fixedbugs/issue5244.go @@ -11625,11 +11628,13 @@ go118/test/typeparam/issue51836.dir/a.go go118/test/typeparam/issue51836.dir/aa.go go118/test/typeparam/issue51836.dir/p.go go118/test/typeparam/issue51836.go +go118/test/typeparam/issue51840.go go118/test/typeparam/issue52026.go go118/test/typeparam/issue52117.dir/a.go go118/test/typeparam/issue52117.dir/b.go go118/test/typeparam/issue52117.go go118/test/typeparam/issue52228.go +go118/test/typeparam/issue52241.go go118/test/typeparam/list.go go118/test/typeparam/list2.go go118/test/typeparam/listimp.dir/a.go diff --git a/lang/go118/distinfo b/lang/go118/distinfo index 8fc342b1e36..f50ca4ae3a9 100644 --- a/lang/go118/distinfo +++ b/lang/go118/distinfo @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.3 2022/05/11 19:00:55 bsiegert Exp $ +$NetBSD: distinfo,v 1.4 2022/06/02 18:50:40 bsiegert Exp $ -BLAKE2s (go1.18.2.src.tar.gz) = 770d1b0c7874bcae1990ba7ab7d8fa519cc1e460efa6a7fe4cf4863ac969a02c -SHA512 (go1.18.2.src.tar.gz) = 9214cbc051cf26b49ab1bd4d8d30b060865944b831578a9ea7fcfe33f84009f77932a39f2948efbfc412b151e4734a3bc1f8332f3bea11b35a912b0e23a4118f -Size (go1.18.2.src.tar.gz) = 22837686 bytes +BLAKE2s (go1.18.3.src.tar.gz) = dd58b076e151844b12c939a8bcc9077b520504553c004622a0631ab04669fd4e +SHA512 (go1.18.3.src.tar.gz) = bacbc74ab8fa4c8de46847cadbd245124491f960c087d6892e2231a73f689d597b9a992c2948c54c0ab4b6476d86d3a6a9a64e1714cb7b2cdfd0a7bcfcd7b5fe +Size (go1.18.3.src.tar.gz) = 22838104 bytes SHA1 (patch-misc_ios_clangwrap.sh) = 0a06403609cb7bce2e6f65444fd322f486761afe SHA1 (patch-src_cmd_dist_util.go) = 2d9c2f59e27672d56f5f1a0e3f9d5101a05546a7 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35 |