Commit 757a2ab
committed
Bump minimum Go version to 1.20
* Bump Go tooling to use 1.20.x for release and testing.
```
Scanning your code and 207 packages across 19 dependent modules for known vulnerabilities...
Vulnerability #1: GO-2023-2043
Improper handling of special tags within script contexts in html/template
More info: https://pkg.go.dev/vuln/GO-2023-2043
Standard library
Found in: html/template@go1.19.8
Fixed in: html/template@go1.21.1
Example traces found:
#1: cmd/troubleshoot.go:127:20: cmd.Status.compile calls template.Template.Execute
Vulnerability exercism#2: GO-2023-2041
Improper handling of HTML-like comments in script contexts in html/template
More info: https://pkg.go.dev/vuln/GO-2023-2041
Standard library
Found in: html/template@go1.19.8
Fixed in: html/template@go1.21.1
Example traces found:
#1: cmd/troubleshoot.go:127:20: cmd.Status.compile calls template.Template.Execute
Vulnerability exercism#3: GO-2023-1987
Large RSA keys can cause high CPU usage in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2023-1987
Standard library
Found in: crypto/tls@go1.19.8
Fixed in: crypto/tls@go1.21rc4
Example traces found:
#1: api/client.go:68:25: api.Client.Do calls http.Client.Do, which eventually calls tls.Conn.HandshakeContext
exercism#2: cli/cli.go:199:23: cli.extractBinary calls io.Copy, which eventually calls tls.Conn.Read
exercism#3: debug/debug.go:32:14: debug.Printf calls fmt.Fprintf, which calls tls.Conn.Write
exercism#4: api/client.go:68:25: api.Client.Do calls http.Client.Do, which eventually calls tls.Dialer.DialContext
Vulnerability exercism#4: GO-2023-1878
Insufficient sanitization of Host header in net/http
More info: https://pkg.go.dev/vuln/GO-2023-1878
Standard library
Found in: net/http@go1.19.8
Fixed in: net/http@go1.20.6
Example traces found:
#1: api/client.go:68:25: api.Client.Do calls http.Client.Do
exercism#2: cmd/troubleshoot.go:206:32: cmd.apiPing.Call calls http.Client.Get
Vulnerability exercism#5: GO-2023-1840
Unsafe behavior in setuid/setgid binaries in runtime
More info: https://pkg.go.dev/vuln/GO-2023-1840
Standard library
Found in: runtime@go1.19.8
Fixed in: runtime@go1.20.5
Example traces found:
#1: debug/debug.go:80:12: debug.DumpResponse calls log.Fatal, which eventually calls runtime.Caller
exercism#2: workspace/exercise_metadata.go:39:26: workspace.NewExerciseMetadata calls json.Unmarshal, which eventually calls runtime.Callers
exercism#3: workspace/exercise_metadata.go:39:26: workspace.NewExerciseMetadata calls json.Unmarshal, which eventually calls runtime.CallersFrames
exercism#4: workspace/exercise_metadata.go:39:26: workspace.NewExerciseMetadata calls json.Unmarshal, which eventually calls runtime.Frames.Next
exercism#5: cmd/root.go:39:27: cmd.Execute calls cobra.Command.Execute, which eventually calls runtime.GC
exercism#6: workspace/exercise_metadata.go:66:24: workspace.ExerciseMetadata.Write calls json.Marshal, which eventually calls runtime.GOMAXPROCS
exercism#7: config/config.go:57:18: config.Dir calls os.Getenv, which eventually calls runtime.GOROOT
exercism#8: cli/cli.go:202:29: cli.extractBinary calls os.File.Seek, which eventually calls runtime.KeepAlive
exercism#9: cli/cli.go:135:2: cli.CLI.Upgrade calls os.File.Close, which eventually calls runtime.SetFinalizer
exercism#10: debug/debug.go:32:14: debug.Printf calls fmt.Fprintf, which eventually calls runtime.Stack
exercism#11: cmd/root.go:39:27: cmd.Execute calls cobra.Command.Execute, which eventually calls runtime.TypeAssertionError.Error
exercism#12: workspace/test_configurations.go:5:2: workspace.init calls runtime.init, which calls runtime.defaultMemProfileRate
exercism#13: workspace/test_configurations.go:5:2: workspace.init calls runtime.init, which calls runtime.efaceOf
exercism#14: workspace/test_configurations.go:5:2: workspace.init calls runtime.init, which eventually calls runtime.findfunc
exercism#15: workspace/test_configurations.go:5:2: workspace.init calls runtime.init, which calls runtime.float64frombits
exercism#16: workspace/test_configurations.go:5:2: workspace.init calls runtime.init, which eventually calls runtime.forcegchelper
exercism#17: workspace/test_configurations.go:5:2: workspace.init calls runtime.init, which eventually calls runtime.funcMaxSPDelta
exercism#18: cmd/root.go:39:27: cmd.Execute calls cobra.Command.Execute, which eventually calls runtime.plainError.Error
exercism#19: workspace/test_configurations.go:5:2: workspace.init calls runtime.init, which eventually calls runtime.throw
Vulnerability exercism#6: GO-2023-1753
Improper handling of empty HTML attributes in html/template
More info: https://pkg.go.dev/vuln/GO-2023-1753
Standard library
Found in: html/template@go1.19.8
Fixed in: html/template@go1.20.4
Example traces found:
#1: cmd/troubleshoot.go:127:20: cmd.Status.compile calls template.Template.Execute
Vulnerability exercism#7: GO-2023-1752
Improper handling of JavaScript whitespace in html/template
More info: https://pkg.go.dev/vuln/GO-2023-1752
Standard library
Found in: html/template@go1.19.8
Fixed in: html/template@go1.20.4
Example traces found:
#1: cmd/troubleshoot.go:127:20: cmd.Status.compile calls template.Template.Execute
Vulnerability exercism#8: GO-2023-1751
Improper sanitization of CSS values in html/template
More info: https://pkg.go.dev/vuln/GO-2023-1751
Standard library
Found in: html/template@go1.19.8
Fixed in: html/template@go1.20.4
Example traces found:
#1: cmd/troubleshoot.go:127:20: cmd.Status.compile calls template.Template.Execute
```1 parent 91d0ba0 commit 757a2ab
4 files changed
Lines changed: 4 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
18 | 18 | | |
19 | 19 | | |
20 | 20 | | |
21 | | - | |
22 | | - | |
| 21 | + | |
23 | 22 | | |
24 | 23 | | |
25 | 24 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
22 | 22 | | |
23 | 23 | | |
24 | 24 | | |
25 | | - | |
| 25 | + | |
26 | 26 | | |
27 | 27 | | |
28 | 28 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
8 | 8 | | |
9 | 9 | | |
10 | 10 | | |
11 | | - | |
| 11 | + | |
12 | 12 | | |
13 | 13 | | |
14 | 14 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| |||
0 commit comments