8a0a545038
This minor release includes 9 security fixes following the security policy: net/http: improper sanitization of Transfer-Encoding header The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid. This is CVE-2022-1705 and https://go.dev/issue/53188. When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected. This is https://go.dev/issue/53423 and CVE-2022-32148. Thanks to Christian Mehlmauer for reporting this issue. compress/gzip: stack exhaustion in Reader.Read Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion. This is CVE-2022-30631 and Go issue https://go.dev/issue/53168. encoding/xml: stack exhaustion in Unmarshal Calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion. This is CVE-2022-30633 and Go issue https://go.dev/issue/53611. encoding/xml: stack exhaustion in Decoder.Skip Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion. The Go Security team discovered this issue, and it was independently reported by Juho Nurminen of Mattermost. This is CVE-2022-28131 and Go issue https://go.dev/issue/53614. encoding/gob: stack exhaustion in Decoder.Decode Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is CVE-2022-30635 and Go issue https://go.dev/issue/53615. path/filepath: stack exhaustion in Glob Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion. Thanks to Juho Nurminen of Mattermost for reporting this issue. This is CVE-2022-30632 and Go issue https://go.dev/issue/53416. io/fs: stack exhaustion in Glob Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion. This is CVE-2022-30630 and Go issue https://go.dev/issue/53415. go/parser: stack exhaustion in all Parse* functions Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion. Thanks to Juho Nurminen of Mattermost for reporting this issue. This is CVE-2022-1962 and Go issue https://go.dev/issue/53616.
69 lines
1.8 KiB
Makefile
69 lines
1.8 KiB
Makefile
# $NetBSD: version.mk,v 1.153 2022/07/13 15:02:02 bsiegert Exp $
|
|
|
|
#
|
|
# If bsd.prefs.mk is included before go-package.mk in a package, then this
|
|
# file must be included directly in the package prior to bsd.prefs.mk.
|
|
#
|
|
.include "go-vars.mk"
|
|
|
|
GO118_VERSION= 1.18.4
|
|
GO117_VERSION= 1.17.12
|
|
GO116_VERSION= 1.16.15
|
|
GO110_VERSION= 1.10.8
|
|
GO19_VERSION= 1.9.7
|
|
GO14_VERSION= 1.4.3
|
|
|
|
.include "../../mk/bsd.prefs.mk"
|
|
|
|
.if ${OPSYS} == "NetBSD" && ${OPSYS_VERSION} < 070000
|
|
# 1.9 is the last Go version to support NetBSD 6
|
|
GO_VERSION_DEFAULT?= 19
|
|
.elif ${OPSYS} == "Darwin" && ${OPSYS_VERSION} < 101000
|
|
# go 1.11 removed support for osx 10.8 and 10.9
|
|
# https://github.com/golang/go/issues/23122
|
|
# darwin version 13.4 is osx 10.9.5
|
|
GO_VERSION_DEFAULT?= 110
|
|
.else
|
|
GO_VERSION_DEFAULT?= 118
|
|
.endif
|
|
|
|
.if !empty(GO_VERSION_DEFAULT)
|
|
GOVERSSUFFIX= ${GO_VERSION_DEFAULT}
|
|
.endif
|
|
|
|
# How to find the Go tool
|
|
GO= ${PREFIX}/go${GOVERSSUFFIX}/bin/go
|
|
|
|
# Build dependency for Go
|
|
GO_PACKAGE_DEP= go${GOVERSSUFFIX}-${GO${GOVERSSUFFIX}_VERSION}*:../../lang/go${GOVERSSUFFIX}
|
|
|
|
ONLY_FOR_PLATFORM= *-*-i386 *-*-x86_64 *-*-earmv[67]hf *-*-aarch64
|
|
NOT_FOR_PLATFORM= SunOS-*-i386
|
|
.if ${MACHINE_ARCH} == "i386"
|
|
GOARCH= 386
|
|
GOCHAR= 8
|
|
.elif ${MACHINE_ARCH} == "x86_64"
|
|
GOARCH= amd64
|
|
GOCHAR= 6
|
|
.elif ${MACHINE_ARCH} == "earmv6hf" || ${MACHINE_ARCH} == "earmv7hf"
|
|
GOARCH= arm
|
|
GOCHAR= 5
|
|
.elif ${MACHINE_ARCH} == "aarch64"
|
|
GOARCH= arm64
|
|
GOOPT= GOARM=7
|
|
# GOHOSTARCH is being misdetected as arm on NetBSD. Unclear why.
|
|
GOOPT+= GOHOSTARCH=arm64
|
|
.endif
|
|
.if ${MACHINE_ARCH} == "earmv6hf"
|
|
GOOPT= GOARM=6
|
|
.elif ${MACHINE_ARCH} == "earmv7hf"
|
|
GOOPT= GOARM=7
|
|
.endif
|
|
GO_PLATFORM= ${LOWER_OPSYS}_${GOARCH}
|
|
PLIST_SUBST+= GO_PLATFORM=${GO_PLATFORM:Q} GOARCH=${GOARCH:Q}
|
|
PLIST_SUBST+= GOCHAR=${GOCHAR:Q}
|
|
|
|
PRINT_PLIST_AWK+= { sub("/${GO_PLATFORM}/", "/$${GO_PLATFORM}/") }
|
|
|
|
TOOLS_CREATE+= go
|
|
TOOLS_PATH.go= ${GO}
|