[security] Go 1.18.4 and Go 1.17.12 are released

282 views
Skip to first unread message

anno...@golang.org

unread,
Jul 12, 2022, 5:28:24 PM7/12/22
to golan...@googlegroups.com

Hello gophers,

We have just released Go versions 1.18.4 and 1.17.12, minor point releases.

These minor releases include 9 security fixes following the security policy:

  • net/http: improper sanitization of Transfer-Encoding header

    The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.

    This is CVE-2022-1705 and https://go.dev/issue/53188.

  • When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.

    This is https://go.dev/issue/53423 and CVE-2022-32148.

    Thanks to Christian Mehlmauer for reporting this issue.

  • compress/gzip: stack exhaustion in Reader.Read

    Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion.

    This is CVE-2022-30631 and Go issue https://go.dev/issue/53168.

  • encoding/xml: stack exhaustion in Unmarshal

    Calling Unmarshal on a XML document into a Go struct which has a nested field that uses the any field tag can cause a panic due to stack exhaustion.

    This is CVE-2022-30633 and Go issue https://go.dev/issue/53611.

  • encoding/xml: stack exhaustion in Decoder.Skip

    Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion.

    The Go Security team discovered this issue, and it was independently reported by Juho Nurminen of Mattermost.

    This is CVE-2022-28131 and Go issue https://go.dev/issue/53614.

  • encoding/gob: stack exhaustion in Decoder.Decode

    Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.

    This is CVE-2022-30635 and Go issue https://go.dev/issue/53615.

  • path/filepath: stack exhaustion in Glob

    Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.

    Thanks to Juho Nurminen of Mattermost for reporting this issue.

    This is CVE-2022-30632 and Go issue https://go.dev/issue/53416.

  • io/fs: stack exhaustion in Glob

    Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.

    This is CVE-2022-30630 and Go issue https://go.dev/issue/53415.

  • go/parser: stack exhaustion in all Parse* functions

    Calling any of the Parse functions on Go source code which contains deeply nested types or declarations can cause a panic due to stack exhaustion.

    Thanks to Juho Nurminen of Mattermost for reporting this issue.

    This is CVE-2022-1962 and Go issue https://go.dev/issue/53616.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.18.4

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
git checkout go1.18.4 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Michael and Heschi for the Go team

Reply all
Reply to author
Forward
0 new messages