[security] Go 1.19.3 and Go 1.18.8 are released

[anno...@golang.org]

Hello gophers,

We have just released Go versions 1.19.3 and 1.18.8, minor point releases.

These minor releases include 1 security fixes following the security policy:

• syscall, os/exec: unsanitized NUL in environment variables

  On Windows, syscall.StartProcess and os/exec.Cmd did not properly check for invalid environment variable values. A malicious environment variable value could exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" set the variables "A=B" and "C=D".

  Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

  This is CVE-2022-41716 and Go issue https://go.dev/issue/56284.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.19.3

You can download binary and source distributions from the Go website:
https://go.dev/dl/

To compile from source using a Git clone, update to the release with
git checkout go1.19.3 and build as usual.

Thanks to everyone who contributed to the releases.

Cheers,
Matthew and Heschi for the Go team

[Wojciech Kaczmarek]

I think it's important to report that  go1.18.8.windows-amd64.msi doesn't match the published sha256 checksum. 

[Heschi Kreinick]

Thanks, good catch. We accidentally signed the installer twice, uploaded the first one, and posted the checksum for the second one. We'll correct the checksum.

[Caleb Spare]

Hmm, I do see a matching checksum
(6d38668862bf9772c0c1c1e0f26aa5dedea9825b33f763b81ccc4aa63df2cef9) for
go1.18.8.windows-amd64.msi.

> --
> You received this message because you are subscribed to the Google Groups "golang-nuts" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/b3a092a1-38a2-452b-9451-ceda7ab0cdcdn%40googlegroups.com.

[Wojciech Kaczmarek]

Thank you Heschi, it worked.

W.

[Heschi Kreinick]

Yep, we fixed the checksums yesterday for all the Windows installers.

You received this message because you are subscribed to a topic in the Google Groups "golang-nuts" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/golang-nuts/_LWRvyo8-Ak/unsubscribe.
To unsubscribe from this group and all its topics, send an email to golang-nuts...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/CAGeFq%2Bk4pq%3DThKCq%3DUgd21vQ7NWn8p_GnTaApyyK6GLzpTekbQ%40mail.gmail.com.