pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/lang
Module Name: pkgsrc
Committed By: bsiegert
Date: Sat Jan 23 14:07:38 UTC 2021
Modified Files:
pkgsrc/lang/go: version.mk
pkgsrc/lang/go115: PLIST distinfo
Log Message:
Update go115 to 1.15.7.
* cmd/go: packages using cgo can cause arbitrary code execution at build time
The go command may execute arbitrary code at build time when cgo is in use on
Windows. This may occur when running “go get”, or any other command that builds
code. Only users who build untrusted code (and don’t execute it) are affected.
In addition to Windows users, this can also affect Unix users who have “.”
listed explicitly in their PATH and are running “go get” or build commands
outside of a module or with module mode disabled.
Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.
This issue is CVE-2021-3115 and Go issue golang.org/issue/43783.
For more background on the cmd/go change and help deciding whether your own
programs might have similar issues, see our blog post at
https://blog.golang.org/path-security.
* crypto/elliptic: incorrect operations on the P-224 curve
The P224() Curve implementation can in rare circumstances generate incorrect
outputs, including returning invalid points from ScalarMult.
The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages
support P-224 ECDSA keys, but they are not supported by publicly trusted
certificate authorities. No other standard library or golang.org/x/crypto
package supports or uses the P-224 curve.
The incorrect output was found by the elliptic-curve-differential-fuzzer
project running on OSS-Fuzz and reported by Philippe Antoine (Catena cyber).
This issue is CVE-2021-3114 and Go issue golang.org/issue/43786.
To generate a diff of this commit:
cvs rdiff -u -r1.108 -r1.109 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.4 -r1.5 pkgsrc/lang/go115/PLIST
cvs rdiff -u -r1.5 -r1.6 pkgsrc/lang/go115/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.108 pkgsrc/lang/go/version.mk:1.109
--- pkgsrc/lang/go/version.mk:1.108 Fri Jan 22 20:08:32 2021
+++ pkgsrc/lang/go/version.mk Sat Jan 23 14:07:37 2021
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.108 2021/01/22 20:08:32 bsiegert Exp $
+# $NetBSD: version.mk,v 1.109 2021/01/23 14:07:37 bsiegert Exp $
#
# If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -7,7 +7,7 @@
.include "go-vars.mk"
GO116_VERSION= 1.16.beta1
-GO115_VERSION= 1.15.5
+GO115_VERSION= 1.15.7
GO114_VERSION= 1.14.14
GO113_VERSION= 1.13.15
GO110_VERSION= 1.10.8
Index: pkgsrc/lang/go115/PLIST
diff -u pkgsrc/lang/go115/PLIST:1.4 pkgsrc/lang/go115/PLIST:1.5
--- pkgsrc/lang/go115/PLIST:1.4 Fri Nov 13 18:45:50 2020
+++ pkgsrc/lang/go115/PLIST Sat Jan 23 14:07:38 2021
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.4 2020/11/13 18:45:50 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.5 2021/01/23 14:07:38 bsiegert Exp $
bin/go${GOVERSSUFFIX}
bin/gofmt${GOVERSSUFFIX}
go115/AUTHORS
@@ -819,6 +819,7 @@ go115/pkg/${GO_PLATFORM}/index/suffixarr
go115/pkg/${GO_PLATFORM}/internal/bytealg.a
go115/pkg/${GO_PLATFORM}/internal/cfg.a
go115/pkg/${GO_PLATFORM}/internal/cpu.a
+go115/pkg/${GO_PLATFORM}/internal/execabs.a
go115/pkg/${GO_PLATFORM}/internal/fmtsort.a
go115/pkg/${GO_PLATFORM}/internal/goroot.a
go115/pkg/${GO_PLATFORM}/internal/goversion.a
@@ -1989,6 +1990,7 @@ go115/src/cmd/go/testdata/script/cgo_asm
go115/src/cmd/go/testdata/script/cgo_bad_directives.txt
go115/src/cmd/go/testdata/script/cgo_depends_on_syscall.txt
go115/src/cmd/go/testdata/script/cgo_flag_contains_space.txt
+go115/src/cmd/go/testdata/script/cgo_path.txt
go115/src/cmd/go/testdata/script/cgo_syso_issue29253.txt
go115/src/cmd/go/testdata/script/clean_cache_n.txt
go115/src/cmd/go/testdata/script/clean_testcache.txt
@@ -2075,6 +2077,7 @@ go115/src/cmd/go/testdata/script/install
go115/src/cmd/go/testdata/script/install_relative_gobin_fail.txt
go115/src/cmd/go/testdata/script/install_shadow_gopath.txt
go115/src/cmd/go/testdata/script/issue36000.txt
+go115/src/cmd/go/testdata/script/ldflag.txt
go115/src/cmd/go/testdata/script/link_syso_issue33139.txt
go115/src/cmd/go/testdata/script/linkname.txt
go115/src/cmd/go/testdata/script/list_ambiguous_path.txt
@@ -4770,6 +4773,8 @@ go115/src/internal/cpu/cpu_x86.go
go115/src/internal/cpu/cpu_x86.s
go115/src/internal/cpu/cpu_x86_test.go
go115/src/internal/cpu/export_test.go
+go115/src/internal/execabs/execabs.go
+go115/src/internal/execabs/execabs_test.go
go115/src/internal/fmtsort/export_test.go
go115/src/internal/fmtsort/sort.go
go115/src/internal/fmtsort/sort_test.go
@@ -6576,6 +6581,7 @@ go115/src/runtime/testdata/testprogcgo/e
go115/src/runtime/testdata/testprogcgo/lockosthread.c
go115/src/runtime/testdata/testprogcgo/lockosthread.go
go115/src/runtime/testdata/testprogcgo/main.go
+go115/src/runtime/testdata/testprogcgo/needmdeadlock.go
go115/src/runtime/testdata/testprogcgo/numgoroutine.go
go115/src/runtime/testdata/testprogcgo/pprof.go
go115/src/runtime/testdata/testprogcgo/raceprof.go
@@ -8950,6 +8956,7 @@ go115/test/fixedbugs/issue4252.dir/a.go
go115/test/fixedbugs/issue4252.dir/main.go
go115/test/fixedbugs/issue4252.go
go115/test/fixedbugs/issue4264.go
+go115/test/fixedbugs/issue42753.go
go115/test/fixedbugs/issue4283.go
go115/test/fixedbugs/issue4313.go
go115/test/fixedbugs/issue4316.go
Index: pkgsrc/lang/go115/distinfo
diff -u pkgsrc/lang/go115/distinfo:1.5 pkgsrc/lang/go115/distinfo:1.6
--- pkgsrc/lang/go115/distinfo:1.5 Fri Nov 13 18:45:50 2020
+++ pkgsrc/lang/go115/distinfo Sat Jan 23 14:07:38 2021
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.5 2020/11/13 18:45:50 bsiegert Exp $
+$NetBSD: distinfo,v 1.6 2021/01/23 14:07:38 bsiegert Exp $
-SHA1 (go1.15.5.src.tar.gz) = 696fee3f3efa184c5d9ad28b048bbd36d7c84ef3
-RMD160 (go1.15.5.src.tar.gz) = c5c60ae185efd5b399d222e2430380da7d3bf5e0
-SHA512 (go1.15.5.src.tar.gz) = 8e1d71f628d364b949b1e124af8950a563bbe9d9ae73b94c66af6ce029f67c26e2654556c0c118d0bc8566af52a7e9ed736b4667bbef7ccdab2bd338c43e6eb4
-Size (go1.15.5.src.tar.gz) = 23019303 bytes
+SHA1 (go1.15.7.src.tar.gz) = 74c101243bc542b4343320837d2eafb8cd3c9992
+RMD160 (go1.15.7.src.tar.gz) = b685bfaa4f92cce54b55f85a216fc7662111c29c
+SHA512 (go1.15.7.src.tar.gz) = 7b3e8bcd2fc95baad41f8b5f0456c009e01896d160e65c2670d51c23d8cfcf7a6801e831e6f9a8877fe58c8f54ac8f75bf6e7935b38ba7aaa51dc8e46cf76ddb
+Size (go1.15.7.src.tar.gz) = 23017978 bytes
SHA1 (patch-misc_io_clangwrap.sh) = df5911c430ff6251abab12e5cc233e32fc3cd953
SHA1 (patch-src_cmd_dist_util.go) = 24e6f1b6ded842a8ce322a40e8766f7d344bc47e
SHA1 (patch-src_cmd_link_internal_ld_elf.go) = 3dfcb5c824d4201fadda0cfb6b48e5938899baf0
Home |
Main Index |
Thread Index |
Old Index