You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficcontrol.apache.org by GitBox <gi...@apache.org> on 2021/03/10 16:48:55 UTC
[GitHub] [trafficcontrol] github-actions[bot] opened a new pull request #5625: Update Go version to 1.15.9
github-actions[bot] opened a new pull request #5625:
URL: https://github.com/apache/trafficcontrol/pull/5625
## What does this PR (Pull Request) do?
- [x] This PR is not related to any Issue
This PR makes the Go components of Traffic Control build using Go version 1.15.9 and updates the `golang.org/x/` dependencies..
See the Go 1.15.9 [release notes](https://golang.org/doc/devel/release.html#go1.15):
<!--
The release notes are licensed with the Go license.
Copyright (c) 2009 The Go Authors. All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above
copyright notice, this list of conditions and the following disclaimer
in the documentation and/or other materials provided with the
distribution.
* Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-->
> <p> go1.15.9 (planned for 2021/03/10) will include security fixes. </p>
## Which Traffic Control components are affected by this PR?
- CDN in a Box - Enroller
- Grove
- Traffic Control Client (Go)
- Traffic Monitor
- Traffic Ops
- Traffic Ops ORT
- Traffic Stats
- CI tests for Go components
## What is the best way to verify this PR?
Run unit tests and API tests. Since this is only a patch-level version update, [the only changes](https://github.com/golang/go/milestone/199?closed=1) were bugfixes. Breaking changes would be unexpected.
## The following criteria are ALL met by this PR
- [x] Existing tests are sufficient, no additional tests necessary
- [x] The documentation only mentions the major Go version, no documentation updates necessary.
- [x] The changelog already mentions updating to Go 1.15, no additional changelog message necessary.
- [x] This PR includes any and all required license headers
- [x] This PR does not include a database migration
- [x] This PR **DOES NOT FIX A SERIOUS SECURITY VULNERABILITY** (see [the Apache Software Foundation's security guidelines](https://www.apache.org/security/) for details)
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] zrhoffman commented on pull request #5625: Update Go version to 1.15.9
Posted by GitBox <gi...@apache.org>.
zrhoffman commented on pull request #5625:
URL: https://github.com/apache/trafficcontrol/pull/5625#issuecomment-797612916
Closing in favor of #5636 now that Go 1.15.10 is released.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] zrhoffman commented on pull request #5625: Update Go version to 1.15.9
Posted by GitBox <gi...@apache.org>.
zrhoffman commented on pull request #5625:
URL: https://github.com/apache/trafficcontrol/pull/5625#issuecomment-795732769
Patches security issues in `encoding/xml` and `archive/zip`:
> <ul><li><span style="background-color:transparent;color:rgb(0,0,0);font-family:Roboto,sans-serif;font-size:10.5pt;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">encoding/xml: infinite loop when using </span><span style="background-color:transparent;color:rgb(0,0,0);font-size:10.5pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-family:"Courier New";vertical-align:baseline;white-space:pre-wrap">xml.NewTokenDecoder</span><span style="background-color:transparent;color:rgb(0,0,0);font-family:Roboto,sans-serif;font-size:10.5pt;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"> with a custom </span><span style="background-color:transparent;color:rgb(0,0,0);font-size:10.5pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-family:"Courier New";vertical-align:baseline;white-space:pre-wrap">TokenReader</span></li></ul><p></p>
</span><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><span><p style="line-height:1.38;margin-top:0pt;margin-bottom:10pt">The <span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">Decode</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">, </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">DecodeElement</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vert
ical-align:baseline;white-space:pre-wrap">, and </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">Skip</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap"> methods of an </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">xml.Decoder</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap"> provided by </span><span style="ba
ckground-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">xml.NewTokenDecoder</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap"> may enter an infinite loop when operating on a custom </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">xml.TokenReader</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap"> which returns an </span><span style="backgrou
nd-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">EOF</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap"> in the middle of an open XML element.</span></p><p style="line-height:1.38;margin-top:0pt;margin-bottom:10pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">Thanks to Sam Whited </span><span style="font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;vertical-align:baseline;white-space:pre-wrap">f</span><span style="background-color:transparent;font-variant-nu
meric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">or reporting this issue.</span></p><p style="line-height:1.38;margin-top:0pt;margin-bottom:10pt"><span style="background-color:transparent;color:rgb(0,0,0);font-family:Roboto,sans-serif;font-size:10.5pt;white-space:pre-wrap;text-indent:36pt">This issue is CVE-2021-27918 and Go issue </span><a href="http://golang.org/issue/44913" style="background-color:transparent;font-family:Roboto,sans-serif;font-size:10.5pt;white-space:pre-wrap;text-indent:36pt" target="_blank" rel="nofollow" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://golang.org/issue/44913&source=gmail&ust=1615481543334000&usg=AFQjCNHdagyoZDwefr2I7T1AVz03B7p84A">golang.org/issue/44913</a><span style="background-color:transparent;color:rgb(0,0,0);font-family:Roboto,sans-serif;font-size:10.5pt;white-space:pre-wrap;text-indent:36pt">.</span></p
></span></blockquote><span><p style="line-height:1.38;margin-top:0pt;margin-bottom:10pt"></p><ul><li><span style="background-color:transparent;color:rgb(0,0,0);font-family:Arial;font-size:11pt;white-space:pre-wrap">archive/zip: panic when calling Reader.Open</span></li></ul><p></p></span><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><span><p style="line-height:1.38;margin-top:0pt;margin-bottom:10pt">The <span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:"Courier New";color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">Reader.Open</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap"> API, new in Go 1.16, will panic when used on a ZIP archive containing files that start with “../”.</span></p><p style="line
-height:1.38;margin-top:0pt;margin-bottom:10pt"><span style="text-indent:36pt;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap">This issue is </span><span style="text-indent:36pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;vertical-align:baseline;white-space:pre-wrap">CVE-2021-27919</span><span style="text-indent:36pt;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-size:10.5pt;font-family:Roboto,sans-serif;color:rgb(0,0,0);vertical-align:baseline;white-space:pre-wrap"> and Go issue <a href="http://golang.org/issue/44916" target="_blank" rel="nofollow" data-saferedirecturl="https://www.google.com/url?hl=en&q=http://golang.org/issue/44916&source=gmail&ust=1615481543334000&usg=AFQjCNFYlgtvQVC9JOYkgViZoKL0gal0PQ">golang.
org/issue/44916</a>.</span></p></span></blockquote>
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficcontrol] zrhoffman closed pull request #5625: Update Go version to 1.15.9
Posted by GitBox <gi...@apache.org>.
zrhoffman closed pull request #5625:
URL: https://github.com/apache/trafficcontrol/pull/5625
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org