From dccc21bb691e4d515eb236ca00a655ab50daa029 Mon Sep 17 00:00:00 2001 From: Benjamin Wang Date: Fri, 9 Dec 2022 07:39:57 +0800 Subject: [PATCH] bump go 1.19.4 $ govulncheck ./... govulncheck is an experimental tool. Share feedback at https://go.dev/s/govulncheck-feedback. Scanning for dependencies with known vulnerabilities... Found 1 known vulnerability. Vulnerability #1: GO-2022-1144 An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. Call stacks in your code: tools/etcd-dump-metrics/main.go:159:31: go.etcd.io/etcd/v3/tools/etcd-dump-metrics.main$4 calls go.etcd.io/etcd/server/v3/embed.StartEtcd, which eventually calls golang.org/x/net/http2.ConfigureServer$1 Found in: golang.org/x/net/http2@v0.2.0 Fixed in: golang.org/x/net/http2@v1.19.4 More info: https://pkg.go.dev/vuln/GO-2022-1144 Vulnerability #2: GO-2022-1144 An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. Call stacks in your code: contrib/lock/storage/storage.go:106:28: go.etcd.io/etcd/v3/contrib/lock/storage.main calls net/http.ListenAndServe contrib/raftexample/httpapi.go:113:31: go.etcd.io/etcd/v3/contrib/raftexample.serveHTTPKVAPI$1 calls net/http.Server.ListenAndServe tools/etcd-dump-metrics/main.go:159:31: go.etcd.io/etcd/v3/tools/etcd-dump-metrics.main$4 calls go.etcd.io/etcd/server/v3/embed.StartEtcd, which eventually calls net/http.Serve tools/etcd-dump-metrics/main.go:159:31: go.etcd.io/etcd/v3/tools/etcd-dump-metrics.main$4 calls go.etcd.io/etcd/server/v3/embed.StartEtcd, which eventually calls net/http.Server.Serve Found in: net/http@go1.19.3 Fixed in: net/http@go1.19.4 More info: https://pkg.go.dev/vuln/GO-2022-1144 Signed-off-by: Benjamin Wang --- .github/workflows/build.yaml | 2 +- .github/workflows/contrib.yaml | 2 +- .github/workflows/coverage.yaml | 2 +- .github/workflows/e2e.yaml | 2 +- .github/workflows/functional.yaml | 2 +- .github/workflows/fuzzing.yaml | 2 +- .github/workflows/govuln.yaml | 2 +- .github/workflows/grpcproxy.yaml | 2 +- .github/workflows/linearizability-nightly.yaml | 2 +- .github/workflows/linearizability.yaml | 2 +- .github/workflows/release.yaml | 2 +- .github/workflows/static-analysis.yaml | 2 +- .github/workflows/tests.yaml | 2 +- tests/functional/Dockerfile | 2 +- tests/manual/Makefile | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index c3aa840db..3b62c733e 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -22,7 +22,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - env: TARGET: ${{ matrix.target }} run: | diff --git a/.github/workflows/contrib.yaml b/.github/workflows/contrib.yaml index a1429c9fd..367baa678 100644 --- a/.github/workflows/contrib.yaml +++ b/.github/workflows/contrib.yaml @@ -8,5 +8,5 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: make -C contrib/mixin tools test diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml index c5225f7f9..c11daf523 100644 --- a/.github/workflows/coverage.yaml +++ b/.github/workflows/coverage.yaml @@ -13,7 +13,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - env: TARGET: ${{ matrix.target }} run: | diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 553a726b8..25a665707 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: date - env: TARGET: ${{ matrix.target }} diff --git a/.github/workflows/functional.yaml b/.github/workflows/functional.yaml index d39d9a024..16fbebda7 100644 --- a/.github/workflows/functional.yaml +++ b/.github/workflows/functional.yaml @@ -13,7 +13,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: date - env: TARGET: ${{ matrix.target }} diff --git a/.github/workflows/fuzzing.yaml b/.github/workflows/fuzzing.yaml index 75bf98a44..bc80bc20b 100644 --- a/.github/workflows/fuzzing.yaml +++ b/.github/workflows/fuzzing.yaml @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: GOARCH=amd64 CPU=4 make fuzz - uses: actions/upload-artifact@v2 if: failure() diff --git a/.github/workflows/govuln.yaml b/.github/workflows/govuln.yaml index 8794daf07..967232646 100644 --- a/.github/workflows/govuln.yaml +++ b/.github/workflows/govuln.yaml @@ -8,6 +8,6 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: date - run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./... diff --git a/.github/workflows/grpcproxy.yaml b/.github/workflows/grpcproxy.yaml index d5fefb4fc..ccaa627d3 100644 --- a/.github/workflows/grpcproxy.yaml +++ b/.github/workflows/grpcproxy.yaml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: date - env: TARGET: ${{ matrix.target }} diff --git a/.github/workflows/linearizability-nightly.yaml b/.github/workflows/linearizability-nightly.yaml index 819f6d7a1..aa71d2985 100644 --- a/.github/workflows/linearizability-nightly.yaml +++ b/.github/workflows/linearizability-nightly.yaml @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: | make gofail-enable make build diff --git a/.github/workflows/linearizability.yaml b/.github/workflows/linearizability.yaml index c61b49caf..a275a8c20 100644 --- a/.github/workflows/linearizability.yaml +++ b/.github/workflows/linearizability.yaml @@ -8,7 +8,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: | make gofail-enable make build diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 4bf0c8347..2feceb091 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -8,7 +8,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: | git config --global user.email "github-action@etcd.io" git config --global user.name "Github Action" diff --git a/.github/workflows/static-analysis.yaml b/.github/workflows/static-analysis.yaml index 8905f46ce..0d65934b8 100644 --- a/.github/workflows/static-analysis.yaml +++ b/.github/workflows/static-analysis.yaml @@ -8,7 +8,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - name: golangci-lint uses: golangci/golangci-lint-action@v3 with: diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 11ee3240c..7aa77b528 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@v2 - uses: actions/setup-go@v2 with: - go-version: "1.19.3" + go-version: "1.19.4" - run: date - env: TARGET: ${{ matrix.target }} diff --git a/tests/functional/Dockerfile b/tests/functional/Dockerfile index eec85ca1d..db8cf3d57 100644 --- a/tests/functional/Dockerfile +++ b/tests/functional/Dockerfile @@ -13,7 +13,7 @@ RUN dnf check-update || true \ ENV GOROOT /usr/local/go ENV GOPATH /go ENV PATH ${GOPATH}/bin:${GOROOT}/bin:${PATH} -ENV GO_VERSION 1.19.3 +ENV GO_VERSION 1.19.4 ENV GO_DOWNLOAD_URL https://storage.googleapis.com/golang RUN rm -rf ${GOROOT} \ && curl -s ${GO_DOWNLOAD_URL}/go${GO_VERSION}.linux-amd64.tar.gz | tar -v -C /usr/local/ -xz \ diff --git a/tests/manual/Makefile b/tests/manual/Makefile index 399af5eba..78b08d699 100644 --- a/tests/manual/Makefile +++ b/tests/manual/Makefile @@ -1,5 +1,5 @@ TMP_DOCKERFILE:=$(shell mktemp) -GO_VERSION ?= 1.19.3 +GO_VERSION ?= 1.19.4 TMP_DIR_MOUNT_FLAG = --tmpfs=/tmp:exec ifdef HOST_TMP_DIR TMP_DIR_MOUNT_FLAG = --mount type=bind,source=$(HOST_TMP_DIR),destination=/tmp