- math/big: panic during recursive division of very large numbers
A number of math/big.Int <https://pkg.go.dev/math/big#Int> methods (Div,
Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD)
can panic when provided crafted large inputs. For the panic to happen, the
divisor or modulo argument must be larger than 3168 bits (on 32-bit
architectures) or 6336 bits (on 64-bit architectures). Multiple math/big.Rat
<https://pkg.go.dev/math/big#Rat> methods are similarly affected.
crypto/rsa.VerifyPSS <https://pkg.go.dev/crypto/rsa#VerifyPSS>,
crypto/rsa.VerifyPKCS1v15 <https://pkg.go.dev/crypto/rsa#VerifyPKCS1v15>,
and crypto/dsa.Verify <https://pkg.go.dev/crypto/dsa#Verify> may panic when
provided crafted public keys and signatures. crypto/ecdsa and
crypto/elliptic operations may only be affected if custom CurveParams
<https://pkg.go.dev/crypto/elliptic#CurveParams> with unusually large field
sizes (several times larger than the largest supported curve, P-521) are in
use. Using crypto/x509.Verify on a crafted X.509 certificate chain can lead
to a panic, even if the certificates don’t chain to a trusted root. The
chain can be delivered via a crypto/tls connection to a client, or to a
server that accepts and verifies client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept
client certificates will recover the panic and are unaffected.
Moreover, an application might crash invoking
crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate
request or during a golang.org/x/crypto/otr conversation. Parsing a
golang.org/x/crypto/openpgp Entity or verifying a signature may crash.
Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host
key, while a server could panic if either PublicKeyCallback accepts a
malformed public key, or if IsUserAuthority accepts a certificate with a
malformed public key.
This issue is CVE-2020-28362 and Go issue golang.org/issue/42552.
- cmd/go: arbitrary code execution at build time through cgo
The go command may execute arbitrary code at build time when cgo is in use.
This may occur when running go get on a malicious package, or any other
command that builds untrusted code.
This can be caused by malicious gcc flags specified via a #cgo directive,
or by a malicious symbol name in a linked object file.
These issues are CVE-2020-28367 and CVE-2020-28366, and Go issues
golang.org/issue/42556 and golang.org/issue/42559 respectively.
- math/big: panic during recursive division of very large numbers
A number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod,
ModInverse, ModSqrt, Jacobi, and GCD) can panic when provided crafted large
inputs. For the panic to happen, the divisor or modulo argument must be larger
than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit
architectures). Multiple math/big.Rat <https://pkg.go.dev/math/big#Rat> methods
are similarly affected.
crypto/rsa.VerifyPSS <https://pkg.go.dev/crypto/rsa#VerifyPSS>,
crypto/rsa.VerifyPKCS1v15 <https://pkg.go.dev/crypto/rsa#VerifyPKCS1v15>,
and crypto/dsa.Verify <https://pkg.go.dev/crypto/dsa#Verify> may panic when
provided crafted public keys and signatures. crypto/ecdsa and
crypto/elliptic operations may only be affected if custom CurveParams
<https://pkg.go.dev/crypto/elliptic#CurveParams> with unusually large field
sizes (several times larger than the largest supported curve, P-521) are in
use. Using crypto/x509.Verify on a crafted X.509 certificate chain can lead
to a panic, even if the certificates don’t chain to a trusted root. The
chain can be delivered via a crypto/tls connection to a client, or to a
server that accepts and verifies client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept
client certificates will recover the panic and are unaffected.
Moreover, an application might crash invoking
crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate
request or during a golang.org/x/crypto/otr conversation. Parsing a
golang.org/x/crypto/openpgp Entity or verifying a signature may crash.
Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host
key, while a server could panic if either PublicKeyCallback accepts a
malformed public key, or if IsUserAuthority accepts a certificate with a
malformed public key.
Thanks to the Go Ethereum team and the OSS-Fuzz project for reporting this.
Thanks to Rémy Oudompheng and Robert Griesemer for their help developing
and validating the fix.
This issue is CVE-2020-28362 and Go issue golang.org/issue/42552.
- cmd/go: arbitrary code execution at build time through cgo
The go command may execute arbitrary code at build time when cgo is in use.
This may occur when running go get on a malicious package, or any other
command that builds untrusted code.
This can be caused by malicious gcc flags specified via a #cgo directive,
or by a malicious symbol name in a linked object file.
These issues are CVE-2020-28367 and CVE-2020-28366, and Go issues
golang.org/issue/42556 and golang.org/issue/42559 respectively.
go1.15.4 (released 2020/11/05) includes fixes to cgo, the compiler, linker,
runtime, and the compress/flate, net/http, reflect, and time packages. See the
Go 1.15.4 milestone on our issue tracker for details.
go1.14.11 (released 2020/11/05) includes fixes to the runtime, and the net/http
and time packages. See the Go 1.14.11 milestone on our issue tracker for
details.
go1.15.2 (released 2020/09/09) includes fixes to the compiler, runtime,
documentation, the go command, and the net/mail, os, sync, and testing
packages. See the Go 1.15.2 milestone on our issue tracker for details.
go1.15.3 (released 2020/10/14) includes fixes to cgo, the compiler, runtime,
the go command, and the bytes, plugin, and testing packages. See the Go 1.15.3
milestone on our issue tracker for details.
go1.14.9 (released 2020/09/09) includes fixes to the compiler, linker, runtime,
documentation, and the net/http and testing packages. See the Go 1.14.9
milestone on our issue tracker for details.
go1.14.10 (released 2020/10/14) includes fixes to the compiler, runtime, and
the plugin and testing packages. See the Go 1.14.10 milestone on our issue
tracker for details.
go1.14.8 (released 2020/09/01) includes security fixes to the net/http/cgi and
net/http/fcgi packages. See the Go 1.14.8 milestone on our issue tracker for
details.
go1.15.1 (released 2020/09/01) includes security fixes to the net/http/cgi and
net/http/fcgi packages. See the Go 1.15.1 milestone on our issue tracker for
details.
The latest Go release, version 1.15, arrives six months after Go 1.14. Most of
its changes are in the implementation of the toolchain, runtime, and libraries.
As always, the release maintains the Go 1 promise of compatibility. We expect
almost all Go programs to continue to compile and run as before.
Go 1.15 includes substantial improvements to the linker, improves allocation
for small objects at high core counts, and deprecates X.509 CommonName. GOPROXY
now supports skipping proxies that return errors and a new embedded tzdata
package has been added.
There are no changes to the language.
go1.14.5 (released 2020/07/14) includes security fixes to the crypto/x509 and
net/http packages. See the Go 1.14.5 milestone on our issue tracker for
details.
go1.14.6 (released 2020/07/16) includes fixes to the go command, the compiler,
the linker, vet, and the database/sql, encoding/json, net/http, reflect, and
testing packages. See the Go 1.14.6 milestone on our issue tracker for details.
go1.13.12 (released 2020/06/01) includes fixes to the runtime, and the go/types
and math/big packages. See the Go 1.13.12 milestone on our issue tracker for
details.
go1.13.13 (released 2020/07/14) includes security fixes to the crypto/x509 and
net/http packages. See the Go 1.13.13 milestone on our issue tracker for details.
go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the
database/sql, net/http, and reflect packages. See the Go 1.13.14 milestone
on our issue tracker for details.
go1.14.3 (released 2020/05/14) includes fixes to cgo, the compiler, the
runtime, and the go/doc and math/big packages. See the Go 1.14.3
milestone on our issue tracker for details.
go1.14.4 (released 2020/06/01) includes fixes to the go doc command, the
runtime, and the encoding/json and os packages. See the Go 1.14.4
milestone on our issue tracker for details.
go1.13.10 (released 2020/04/08) includes fixes to the go command, the
runtime, os/exec, and time packages. See the Go 1.13.10 milestone on our
issue tracker for details.
go1.14.2 (released 2020/04/08) includes fixes to cgo, the go command, the
runtime, os/exec, and testing packages. See the Go 1.14.2 milestone on our
issue tracker for details.
From what I know from work, 1.14.1 had a nasty runtime bug that is now
fixed.
The default will remain at 1.13 for the next branch.
The latest Go release, version 1.14, arrives six months after Go 1.13. Most of
its changes are in the implementation of the toolchain, runtime, and libraries.
As always, the release maintains the Go 1 promise of compatibility. We expect
almost all Go programs to continue to compile and run as before.
See the release notes at https://golang.org/doc/go1.14.
We don't currently build any packages using modules, and the switch to
newer versions of Go has resulted in the default changing to modules
being sometimes enabled.
This now causes random packages to begin fetching from the Internet during
builds, which goes against pkgsrc policy.
Doesn't seem to harm the ability to build a random subset of the Go packages
in pkgsrc.
Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte
On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.
The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.
Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue.
The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.
This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of
golang.org/x/crypto/cryptobyte.
Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte
On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.
The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.
Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue.
The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.
This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of
golang.org/x/crypto/cryptobyte.
pkglint -r --network --only "migrate"
As a side-effect of migrating the homepages, pkglint also fixed a few
indentations in unrelated lines. These and the new homepages have been
checked manually.
I did a preliminary bulk build to find build failures resulting from this
change and fixed the fallout in www/grafana. Everything else seemed to be
ok.
go1.12.13 (released 2019/10/31) fixes an issue on macOS 10.15 Catalina where
the non-notarized installer and binaries were being rejected by Gatekeeper.
Only macOS users who hit this issue need to update.
go1.12.14 (released 2019/12/04) includes a fix to the runtime. See the Go
1.12.14 milestone on our issue tracker for details.
It's not always possible to include go-package.mk earlier than bsd.prefs.mk
in a package, for example if the package defines its own do-install target,
so move out the *_SUPPORTED variables that need to be included first.
qo1.12.11 (released 2019/10/17) includes security fixes to the crypto/dsa
package. See the Go 1.12.11 milestone on our issue tracker for details.
go1.12.12 (released 2019/10/17) includes fixes to the go command, runtime,
syscall and net packages. See the Go 1.12.12 milestone on our issue tracker
for details.
Commit ok'd by wiz@ for PMC.
Go 1.12.10:
net/http (through net/textproto) used to accept and normalize invalid
HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If
a Go server is used behind an uncommon reverse proxy that accepts and
forwards but doesn't normalize such invalid headers, the reverse proxy and
the server can interpret the headers differently. This can lead to filter
bypasses or request smuggling, the latter if requests from separate clients
are multiplexed onto the same upstream connection by the proxy. Such invalid
headers are now rejected by Go servers, and passed without normalization to
Go client applications.
The issue is CVE-2019-16276 and Go issue golang.org/issue/34540.
Go 1.12.9:
go1.12.9 (released 2019/08/15) includes fixes to the linker, and the os and
math/big packages. See the Go 1.12.9 milestone on our issue tracker for
details.
