CVS commit: pkgsrc/lang

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Sun Feb  2 09:26:39 UTC 2020

Modified Files:
        pkgsrc/lang/go: version.mk
        pkgsrc/lang/go112: distinfo

Log Message:
Update go112 to 1.12.16 (security release).

Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte

On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.

The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.

Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue.

The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.

This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of
golang.org/x/crypto/cryptobyte.


To generate a diff of this commit:
cvs rdiff -u -r1.78 -r1.79 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.10 -r1.11 pkgsrc/lang/go112/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.78 pkgsrc/lang/go/version.mk:1.79
--- pkgsrc/lang/go/version.mk:1.78      Fri Jan 10 12:56:35 2020
+++ pkgsrc/lang/go/version.mk   Sun Feb  2 09:26:39 2020
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.78 2020/01/10 12:56:35 bsiegert Exp $
+# $NetBSD: version.mk,v 1.79 2020/02/02 09:26:39 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -7,7 +7,7 @@
 .include "go-vars.mk"
 
 GO113_VERSION= 1.13.6
-GO112_VERSION= 1.12.15
+GO112_VERSION= 1.12.16
 GO111_VERSION= 1.11.13
 GO110_VERSION= 1.10.8
 GO19_VERSION=  1.9.7

Index: pkgsrc/lang/go112/distinfo
diff -u pkgsrc/lang/go112/distinfo:1.10 pkgsrc/lang/go112/distinfo:1.11
--- pkgsrc/lang/go112/distinfo:1.10     Fri Jan 10 12:53:01 2020
+++ pkgsrc/lang/go112/distinfo  Sun Feb  2 09:26:39 2020
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.10 2020/01/10 12:53:01 bsiegert Exp $
+$NetBSD: distinfo,v 1.11 2020/02/02 09:26:39 bsiegert Exp $
 
-SHA1 (go1.12.15.src.tar.gz) = 8f104d4718abe9e9301d6529bd83e2b7e2d3855e
-RMD160 (go1.12.15.src.tar.gz) = 26761a6ab380fd449e14d677b1b680c717284810
-SHA512 (go1.12.15.src.tar.gz) = 887e331c73b9d174e4a707a85be389fa0de43c77bc191ef5e0fe326ac7285374404450ca081cb8e92514a973d25d0314ca74eb17c8e53f8386e1798edd9d41aa
-Size (go1.12.15.src.tar.gz) = 20726294 bytes
+SHA1 (go1.12.16.src.tar.gz) = 4cc4b826a99268ae596e21447e2fe228baa2ef1b
+RMD160 (go1.12.16.src.tar.gz) = 8c33946ad3892c6f9f0de01c1875fa41d23dc0e6
+SHA512 (go1.12.16.src.tar.gz) = 715f9c10ff06a5475cf49a621e97df93808e42e48f534ca1a3377115a553e183f76b5277f2673bf5d418430c94efb35d87ebe0c63976ae71743997fe76a2598c
+Size (go1.12.16.src.tar.gz) = 20725779 bytes
 SHA1 (patch-misc_io_clangwrap.sh) = cd91c47ba0fe7b6eb8009dd261c0c26c7d581c29
 SHA1 (patch-src_cmd_dist_util.go) = 24e6f1b6ded842a8ce322a40e8766f7d344bc47e
 SHA1 (patch-src_cmd_link_internal_ld_elf.go) = 990a54e3baf239916e4c7f0c1d54240e2898601a