Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of [NET-8368] security: bump Go version to 1.21.8 into release/1.16.x #761

Open
1 of 4 tasks
dhiaayachi opened this issue Sep 26, 2024 · 0 comments
Open
1 of 4 tasks

Comments

@dhiaayachi
Copy link
Owner

Backport

This PR is auto-generated from hashicorp#20812 to be assessed for backporting due to the inclusion of the label backport/1.16.

The below text is copied from the body of the original PR.


This bumps go version to 1.21.8.

Description

Resolves multiple CVEs from the latest Go release.
CVE-2024-24783 (crypto/x509).
CVE-2023-45290 (net/http).
CVE-2023-45289 (net/http, net/http/cookiejar).
CVE-2024-24785 (html/template).
CVE-2024-24784 (net/mail).

Resolves Docker Scout scanner vulnerabilities on the Consul Go base image by using alpine3.19
CVE-2023-52425
CVE-2023-52426⁠

Testing & Reproduction steps

make go-build-image

PR Checklist

  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

Overview of commits
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant