summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/go/go-1.18
Commit message (Collapse)AuthorAgeFilesLines
* go: Fix for CVE-2023-45288Vijay Anusuri2024-05-021-0/+95
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/e55d7cf8435ba4e58d4a5694e63b391821d4ee9b (From OE-Core rev: 9ad10bf355665ff799cefd40fb0d1938b0104b08) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Backport fix CVE-2024-24784 & CVE-2024-24785Vivek Kumbhar2024-03-132-0/+403
| | | | | | | | | | | | Backport fixes for : CVE-2024-24784 - Upstream-Status: Backport from https://github.com/golang/go/commit/5330cd225ba54c7dc78c1b46dcdf61a4671a632c CVE-2024-24785 - Upstream-Status: Backport from https://github.com/golang/go/commit/056b0edcb8c152152021eebf4cf42adbfbe77992 (From OE-Core rev: 408f86a5268cadd680f45e2d934451a321241706) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: add a complementary fix for CVE-2023-29406Ming Liu2024-02-282-0/+114
| | | | | | | | | | The original CVE-2023-29406.patch is not complete, causing docker failures at runtime, backport a complementary fix from golang upstream. (From OE-Core rev: 973901530c98bc3f1b10d8bb89d55decf6848713) Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Update fix for CVE-2023-24538 & CVE-2023-39318Shubham Kulkarni2023-10-052-6/+766
| | | | | | | | | | | | | Add missing files in fix for CVE-2023-24538 & CVE-2023-39318 Upstream Link - CVE-2023-24538: https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b CVE-2023-39318: https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c (From OE-Core rev: 0d8f7062d4fb5525f34427b1a7304f165bee0cfc) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29406 net/http insufficient sanitization of Host headerVivek Kumbhar2023-08-021-0/+210
| | | | | | | (From OE-Core rev: 5dc74138649ab7a2c0158a43225dc7a8fd732355) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-29400 html/template improper handling of empty HTML attributesVivek Kumbhar2023-07-121-0/+99
| | | | | | | (From OE-Core rev: 3224084a1ca301ff4fb4735ccc80d24aaec13257) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24539 html/template improper sanitization of CSS valuesVivek Kumbhar2023-06-141-0/+53
| | | | | | | | | | | | | | | | | | Angle brackets should not appear in CSS contexts, as they may affect token boundaries (such as closing a <style> tag, resulting in injection). Instead emit filterFailsafe, matching the behavior for other dangerous characters. Thanks to Juho Nurminen of Mattermost for reporting this issue. For #59720 Fixes #59811 Fixes CVE-2023-24539 (From OE-Core rev: 0a09194f3d4ad98d0cf0d070ec0c99e7a6c8a158) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Security fix for CVE-2023-24538Shubham Kulkarni2023-05-101-0/+208
| | | | | | | | | | | html/template: disallow actions in JS template literals Backport from https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b (From OE-Core rev: 835462d697a5f294900843b8bcd628709c256605) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24534 denial of service from excessive memory allocationVivek Kumbhar2023-05-101-0/+200
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A parsed MIME header is a map[string][]string. In the common case, a header contains many one-element []string slices. To avoid allocating a separate slice for each key, ReadMIMEHeader looks ahead in the input to predict the number of keys that will be parsed, and allocates a single []string of that length. The individual slices are then allocated out of the larger one. The prediction of the number of header keys was done by counting newlines in the input buffer, which does not take into account header continuation lines (where a header key/value spans multiple lines) or the end of the header block and the start of the body. This could lead to a substantial amount of overallocation, for example when the body consists of nothing but a large block of newlines. Fix header key count prediction to take into account the end of the headers (indicated by a blank line) and continuation lines (starting with whitespace). Thanks to Jakob Ackermann (@das7pad) for reporting this issue. Fixes CVE-2023-24534 For #58975 Fixes #59267 (From OE-Core rev: 28bfa033ce965d7316a8b4296d10f3ad74d711db) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24537 Infinite loop in parsingVivek Kumbhar2023-04-261-0/+75
| | | | | | | | | | | | | | | | | Setting a large line or column number using a //line directive can cause integer overflow even in small source files. Limit line and column numbers in //line directives to 2^30-1, which is small enough to avoid int32 overflow on all reasonbly-sized files. Fixes CVE-2023-24537 Fixes #59273 For #59180 (From OE-Core rev: 15c07dff384ce4fb0e90f4f32c182a82101a1c82) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41722Shubham Kulkarni2023-04-261-0/+103
| | | | | | | | | | | path/filepath: do not Clean("a/../c:/b") into c:\b on Windows Backport from https://github.com/golang/go/commit/bdf07c2e168baf736e4c057279ca12a4d674f18c (From OE-Core rev: f60637b3c9045656047d6ffcfaadbef5ad1d3d06) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41723Shubham Kulkarni2023-04-111-0/+156
| | | | | | | | | | | | | Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. Backport from https://github.com/golang/go/commit/5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3 (From OE-Core rev: 7440ebac50813e5df73da2d660a50fa97de650de) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-2879 and CVE-2022-41720Sakib Sajal2023-04-112-0/+691
| | | | | | | | | | | | | | Backport appropriate patches to fix CVE-2022-2879 and CVE-2022-41720. Modified the original fix for CVE-2022-2879 to remove a testdata tarball and any references to it since git binary diffs are not supported in quilt. (From OE-Core rev: a896cebe1ce2363b501723475154350acf0e0783) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-41717 Excessive memory use in got serverHitendra Prajapati2023-01-261-0/+89
| | | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/618120c165669c00a1606505defea6ca755cdc27 (From OE-Core rev: f4d179aab7c8f55669ac652a0668644859ec2eb7) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* golang: CVE-2022-41715 regexp/syntax: limit memory used by parsing regexpsHitendra Prajapati2022-12-231-0/+270
| | | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/e9017c2416ad0ef642f5e0c2eab2dbf3cba4d997 (From OE-Core rev: d5a533b86ce68b4c3cd2d3c3dd198c2897d37587) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-2880Sakib Sajal2022-12-011-0/+178
| | | | | | | | | | Backport patch to fix CVE-2022-2880. (From OE-Core rev: a38f8316fdd0c9fc6fc7af195973028370935ba3) Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-27664Teoh Jay Shen2022-09-281-0/+102
| | | | | | | | | Upstream-Status: Backport [https://github.com/golang/go/commit/5bc9106458fc07851ac324a4157132a91b1f3479] (From OE-Core rev: fecad1b8e0f006c0186941706219d39c6c8ba5eb) Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: upgrade 1.17.7 -> 1.17.8wangmy2022-03-0911-0/+1013
(From OE-Core rev: c375fcae8fd4c21a9f240440f9d7f31dde415e30) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 02:55:19 +0000