8000 Update to Go 1.19.3 to address CVE-2022-41716 · moby/moby@4701ca9 · GitHub
[go: up one dir, main page]
Skip to content

Commit 4701ca9

Browse files
corherecorhere
committed
Update to Go 1.19.3 to address CVE-2022-41716
On Windows, syscall.StartProcess and os/exec.Cmd did not properly check for invalid environment variable values. A malicious environment variable value could exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" set the variables "A=B" and "C=D". Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue. This is CVE-2022-41716 and Go issue https://go.dev/issue/56284. This Go release also fixes golang/go#56309, a runtime bug which can cause random memory corruption when a goroutine exits with runtime.LockOSThread() set. This fix is necessary to unblock work to replace certain uses of pkg/reexec with unshared OS threads. Signed-off-by: Cory Snider <csnider@mirantis.com> (cherry picked from commit f9d4589) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
1 parent 091b889 commit 4701ca9

File tree

4 files changed

+4
-4
lines changed

4 files changed

+4
-4
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
ARG CROSS="false"
44
ARG SYSTEMD="false"
55
# IMPORTANT: When updating this please note that stdlib archive/tar pkg is vendored
6-
ARG GO_VERSION=1.19.2
6+
ARG GO_VERSION=1.19.3
77
ARG DEBIAN_FRONTEND=noninteractive
88
ARG VPNKIT_VERSION=0.5.0
99
ARG DOCKER_BUILDTAGS="apparmor seccomp"

‎Dockerfile.e2e‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
ARG GO_VERSION=1.19.2
1+
ARG GO_VERSION=1.19.3
22

33
FROM golang:${GO_VERSION}-alpine AS base
44
ENV GO111MODULE=off

‎Dockerfile.simple‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
# This represents the bare minimum required to build and test Docker.
77

8-
ARG GO_VERSION=1.19.2
8+
ARG GO_VERSION=1.19.3
99

1010
FROM golang:${GO_VERSION}-buster
1111
ENV GO111MODULE=off

‎Dockerfile.windows‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ FROM microsoft/windowsservercore
165165
# Use PowerShell as the default shell
166166
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
167167

168-
ARG GO_VERSION=1.19.2
168+
ARG GO_VERSION=1.19.3
169169
ARG GOTESTSUM_VERSION=v1.8.2
170170

171171
# Environment variable notes:

0 commit comments

Comments
 (0)
0