summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/go
AgeCommit message (Collapse)Author
2022-11-23golang: ignore CVE-2022-30630Ralph Siemsen
The CVE is in the io/fs package, which first appeared in go1.16. Since dunfell is using go1.14, this issue does not apply. CVE was fixed in fa2d41d0ca736f3ad6b200b2a4e134364e9acc59 Original code in b64202bc29b9c1cf0118878d1c0acc9cdb2308f6 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: ignore CVE-2022-30580Ralph Siemsen
Only affects Windows platform, as per the release announcement [1]: "If, on Windows, Cmd.Run, cmd.Start, cmd.Output, or cmd.CombinedOutput are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed." [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: ignore CVE-2021-41772Ralph Siemsen
Dunfell uses golang 1.14 which does not contain the affected code (it was introduced in golang 1.16). From the golang announcement [1] "Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can be made to panic by an attacker providing either a crafted ZIP archive containing completely invalid names or an empty filename argument. [1] https://groups.google.com/g/golang-announce/c/0fM21h43arc Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: ignore CVE-2021-33194Ralph Siemsen
This is a bug in golang.org/x/net/html/parse.go. The golang compiler includes a partial copy of this under src/vendor/golang.org/x/net/ however the "html" subdirectory is not included. So this bug does not apply to the compiler itself. Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: ignore CVE-2022-29804Ralph Siemsen
The issue only affects Windows per the golang announcement [1]: On Windows, the filepath.Clean function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. [1] https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: fix CVE-2022-28327Ralph Siemsen
Upstream-Status: Backport [https://github.com/golang/go/commit/7139e8b024604ab168b51b99c6e8168257a5bf58] CVE: CVE-2022-28327 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: fix CVE-2022-28131Ralph Siemsen
Upstream-Status: Backport [https://github.com/golang/go/commit/58facfbe7db2fbb9afed794b281a70bdb12a60ae] CVE: CVE-2022-28131 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: fix CVE-2022-24291Ralph Siemsen
Upstream-Status: Backport [https://github.com/golang/go/commit/2b65cde5868d8245ef8a0b8eba1e361440252d3b] CVE: CVE-2022-24921 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: fix CVE-2021-44716Ralph Siemsen
Upstream-Status: Backport [https://github.com/golang/go/commit/d0aebe3e74fe14799f97ddd3f01129697c6a290a] CVE: CVE-2021-44716 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: fix CVE-2021-33198Ralph Siemsen
Upstream-Status: Backport [https://github.com/golang/go/commit/df9ce19db6df32d94eae8760927bdfbc595433c3] CVE: CVE-2021-33198 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-23golang: fix CVE-2021-33195Ralph Siemsen
Upstream-Status: Backport [https://github.com/golang/go/commit/31d60cda1f58b7558fc5725d2b9e4531655d980e] CVE: CVE-2021-33195 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-11-10go: Security Fix for CVE-2022-2879Sunil Kumar
archive/tar: limit size of headers Set a 1MiB limit on special file blocks (PAX headers, GNU long names, GNU link names), to avoid reading arbitrarily large amounts of data into memory. Link: https://github.com/golang/go/commit/0a723816cd2 Signed-off-by: Sunil Kumar <sukumar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-10-27golang: CVE-2022-2880 ReverseProxy should not forward unparseable query ↵Hitendra Prajapati
parameters Upstream-Status: Backport from https://github.com/golang/go/commit/9d2c73a9fd69e45876509bb3bdb2af99bf77da1e Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-09-29go: Add fix for CVE-2022-32190Shubham Kulkarni
Link: https://github.com/golang/go/commit/28335508913a46e05ef0c04a18e8a1a6beb775ec Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-09-29golang: CVE-2022-27664 net/http: handle server errors after sending GOAWAYHitendra Prajapati
Source: https://github.com/golang/go MR: 121912 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/5bc9106458fc07851ac324a4157132a91b1f3479 ChangeID: 0b76a92a774279d7bffc9d6fa05564dfd8371e8c Description: CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-09-14go: fix and ignore several CVEsChee Yang Lee
backport fixes: CVE-2021-27918 CVE-2021-36221 CVE-2021-39293 CVE-2021-41771 ignore: CVE-2022-29526 CVE-2022-30634 Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-08-29golang: CVE-2022-32189 a denial of serviceHitendra Prajapati
Source: https://github.com/golang/go MR: 120634 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/703c8ab7e5ba75c95553d4e249309297abad7102 ChangeID: 3ade323dd52a6b654358f6738a0b3411ccc6d3f8 Description: CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-08-29golang: fix CVE-2022-30635 and CVE-2022-32148Hitendra Prajapati
Source: https://github.com/golang/go MR: 120628, 120631 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/ed2f33e1a7e0d18f61bd56f7ee067331d612c27e && https://github.com/golang/go/commit/ed2f33e1a7e0d18f61bd56f7ee067331d612c27e ChangeID: fbd8d61bdc2e9cb0cdbe9879e02aed218ee93dbe Description: Fixed CVE: 1. CVE-2022-30635 2. CVE-2022-32148 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-08-29golang: fix CVE-2022-30632 and CVE-2022-30633Hitendra Prajapati
Source: https://github.com/golang/go MR: 120622, 120625 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/76f8b7304d1f7c25834e2a0cc9e88c55276c47df && https://github.com/golang/go/commit/2678d0c957193dceef336c969a9da74dd716a827 ChangeID: aabb29a6dd6a89842f451c95af228aaf66e58bb5 Description: Fixed CVE: 1. CVE-2022-30632 2. CVE-2022-30633 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-08-29golang: fix CVE-2022-30629 and CVE-2022-30631Hitendra Prajapati
Source: https://github.com/golang/go MR: 120613, 120613 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/c15a8e2dbb5ac376a6ed890735341b812d6b965c && https://github.com/golang/go/commit/0117dee7dccbbd7803d88f65a2ce8bd686219ad3 ChangeID: 366db775dec045d7b312b8da0436af36ab322046 Description: Fixed CVE: 1. CVE-2022-30629 2. CVE-2022-30631 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-06-24golang: CVE-2021-31525 net/http: panic in ReadRequest and ReadResponse when ↵Hitendra Prajapati
reading a very large header Source: https://github.com/argoheyard/lang-net MR: 114874 Type: Security Fix Disposition: Backport from https://github.com/argoheyard/lang-net/commit/701957006ef151feb43f86aa99c8a1f474f69282 ChangeID: bd3c4f9f44dd1c45e810172087004778522d28eb Description: CVE-2021-31525 golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-06-24golang: CVE-2022-24675 encoding/pem: fix stack overflow in DecodeHitendra Prajapati
Source: https://go-review.googlesource.com/c/go MR: 117551 Type: Security Fix Disposition: Backport from https://go-review.googlesource.com/c/go/+/399816/ ChangeID: 347f22f93e8eaecb3d39f8d6c0fe5a70c5cf7b7c Description: CVE-2022-24675 golang: encoding/pem: fix stack overflow in Decode. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-06-20golang: CVE-2021-44717 syscall: don't close fd 0 on ForkExec errorHitendra Prajapati
Source: https://github.com/golang/go MR: 114884 Type: Security Fix Disposition: Backport from https://github.com/golang/go/commit/44a3fb49 ChangeID: 7b28553d4e23828b20c3357b1cca79ee3ca18058 Description: CVE-2021-44717 golang: syscall: don't close fd 0 on ForkExec error. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-04-04go: backport patch fix for CVE-2021-38297Davide Gardenal
Patch taken from https://github.com/golang/go/commit/4548fcc8dfd933c237f29bba6f90040a85922564 from the following issue https://github.com/golang/go/issues/48797 Original repo https://go.googlesource.com/go/+/77f2750f4398990eed972186706f160631d7dae4 Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-02-28go: fix CVE-2022-23772Minjae Kim
math/big: prevent large memory consumption in Rat.SetString An attacker can cause unbounded memory growth in a program using (*Rat).SetString due to an unhandled overflow. Upstream-Status: Backport [https://go.dev/issue/50699] CVE: CVE-2022-23772 Signed-off-by:Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2022-02-28go: fix CVE-2022-23806Minjae Kim
crypto/elliptic: fix IsOnCurve for big.Int values that are not valid coordinates Some big.Int values that are not valid field elements (negative or overflowing) might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values. Upstream-Status: Backport [https://go.dev/issue/50974] CVE: CVE-2022-23806 Signed-off-by:Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-11-03meta: Add explict branch to git SRC_URIs, handle github url changesSteve Sakoman
This update was made with the convert-scruri.py script in scripts/contrib This script handles two emerging issues: 1. There is uncertainty about the default branch name in git going forward. To try and cover the different possible outcomes, add branch names to all git:// and gitsm:// SRC_URI entries. 2. Github are dropping support for git:// protocol fetching, so remap github urls as needed. For more details see: https://github.blog/2021-09-01-improving-git-protocol-security-github/ Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-09-10go: Several Security fixesArmin Kuster
Source: golang.org MR: 111958, 112390, 112393 Type: Security Fix Disposition: Backport from https://github.com/golang/go.git ChangeID: 662d021814f025b3d768a04864498486f94819a7 Description: Affects < 1.16.5 Fixes: CVE-2021-33196 CVE-2021-33197 CVE-2021-34558 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-09-10go: Exclude CVE-2021-29923 from report listRichard Purdie
Upstream don't believe it is a signifiant real world issue and will only fix in 1.17 onwards. Therefore exclude it from our reports. https://github.com/golang/go/issues/30999#issuecomment-910470358 Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5bd5faf0c34b47b2443975d66b71482d2380a01a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-04-19go_1.14: don't set -buildmode=pie when building for windows targetsPeter Morrow
go 1.14 for windows targets does not support -buildmode=pie, disable it and use the default buildmode instead. Support for -buildmode=pie for windows targets is added with go 1.15 (https://golang.org/doc/go1.15) which is added to poky in gatesgarth. Signed-off-by: Peter Morrow <pemorrow@linux.microsoft.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2021-03-04go: update to 1.14.15Lee Chee Yang
updates include fixes for CVE-2021-3114 CVE-2021-3115 Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-12-03go: update to 1.14.12Lee Chee Yang
update minor version to 1.14.12 go1.14.8 includes security fixes to the net/http/cgi and net/http/fcgi packages. go1.14.9 includes fixes to the compiler, linker, runtime, documentation, and the net/http and testing packages. go1.14.10 includes fixes to the compiler, runtime, and the plugin and testing packages. go1.14.11 includes fixes to the runtime, and the net/http and time packages. go1.14.12 includes security fixes to the cmd/go and math/big packages. Release notes: https://golang.org/doc/devel/release.html#go1.14.minor updates include fix for CVE-2020-24553 CVE-2020-28362 CVE-2020-28366 CVE-2020-28367 Also backport patch to fix below CGO_LDFLAGS error | Building std for target, linux/amd64. | go build runtime/cgo: invalid flag in go:cgo_ldflag: -Wl,-O1 Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-08-12go: Upgrade to 1.14.7Khem Raj
CVE_CHECK_WHITELIST += "CVE-2020-16845" Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Li Zhou <li.zhou@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 91580c9d335e0fbee95f94be6f9b34298d3e9a48) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-08-12go: update 1.14.4 -> 1.14.6Khem Raj
Includes security Fixes for CVE-2020-14039 and CVE-2020-15586 (cherry picked from commit 97d5c2d1f2dffe2518f46bbe57cb9348eb59c633) (cherry picked from commit 6591d269792fe864d7af4e379035f1cebc4510f5) (cherry picked from commit c9011d04eb624aeabf5d707e88de80137bcc2eb1) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-07-13go-dep: Fix build on riscv64Khem Raj
Bring in only patch from meta-riscv here Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2e6e7b0be6e5ba5ab8fe9478c1dfdd530d22123f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-07-13go: Disbale CGO for riscv64Khem Raj
cgo is still not available in go for riscv64, we will re-evaluate it once we upgrade to 1.15 Fixes | /usr/src/debug/go-runtime/1.14.4-r0/go/src/runtime/cgo/gcc_util.c:23: undefined reference to `_cgo_sys_thread_start' [YOCTO #13966] Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f512b3308ed6ee878c77f72b9235ada83d107dba) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-06-23go-dep: Avoid use of 'go mod' supportOtavio Salvador
dep utility must not use 'go mod' support, so we explicitly disable it. Signed-off-by: Otavio Salvador <otavio@ossystems.com.br> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b34000ae3dd6e0a1d7fc332efb35c5da84cf2275) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-05-01go: Rely on go-runtime to provide needed modulesKhem Raj
go compiler is including go/src/cmd modules in -dev package which is in conflict with go-runtime-dev which provides exact same copy of this module along with other runtime modules, as a result when both go-dev and go-runtime-dev are included in image then it results in rootfs failures, here lets make go depend on go-runtime and dont install the cmd module here explicitly. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2020-03-23go: Update to 1.14.1 minor releaseKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-28go: Update to 1.14 release seriesKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-22go: Upgrade to 1.13.8 minor releaseKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-27go: Disable PIE on RISCVKhem Raj
Its not supported yet Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-27go-dep: Fix bolt for riscv64Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-28go: upgrade 1.13.3 -> 1.13.5Tim Orling
go1.13.4 (released 2019/10/31) includes fixes to the net/http and syscall packages. It also fixes an issue on macOS 10.15 Catalina where the non- notarized installer and binaries were being rejected by Gatekeeper. See the Go 1.13.4 milestone on our issue tracker for details. https://github.com/golang/go/issues?q=milestone%3AGo1.13.4 go1.13.5 (released 2019/12/04) includes fixes to the go command, the runtime, the linker, and the net/http package. See the Go 1.13.5 milestone on our issue tracker for details. https://github.com/golang/go/issues?q=milestone%3AGo1.13.5 Signed-off-by: Tim Orling <timothy.t.orling@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-12-15Revert "go: Reset unneeded GOARCH variables for native recipe"Khem Raj
This reverts commit 4825eede606b075d0d529b38d6162999f1dec506. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-05go: Reset unneeded GOARCH variables for native recipeKhem Raj
These variables depend on TUNE_FEATURES variable and that creeps into dependencies for native as well as a result, which means go-native gets recompiled everytime machine/arch is changed. Fixes sstate differences found e.g. basehash changed from 600fb6be571fa4853232a7fed78945ee19b324e54b1b94cff93ef472b6290103 to 994de861190a56064d3e186d9c411152127e230bf2f77b17e59b2c5932a41249 List of dependencies for variable TUNE_FEATURES changed from '{'TUNE_FEATURES_tune-core2-32', 'DEFAULTTUNE'}' to '{'TUNE_FEATURES_tune-armv7vethf-neon', 'DEFAULTTUNE'}' changed items: {'TUNE_FEATURES_tune-core2-32', 'TUNE_FEATURES_tune-armv7vethf-neon'} Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-25go: Extract common environment setup.Alex Kube
Add default values for go environment variables to go-common.inc. Override where appropriate in other go*.inc files, and use host/target tuples from goarch for setting CC flags. Signed-off-by: Alex Kube <alexander.j.kube@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-11-25go: Remove go-1.12Alex Kube
Signed-off-by: Alex Kube <alexander.j.kube@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-11-25go: Add go1.13 recipesAlex Kube
Signed-off-by: Alex Kube <alexander.j.kube@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-11-14go: Refactor patches for 1.13.3Alex Kube
Signed-off-by: Alex Kube <alexander.j.kube@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-09-26 02:37:40 +0000