Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Golang to latest release #10140

Closed
guidovranken opened this issue Apr 21, 2023 · 4 comments
Closed

Update Golang to latest release #10140

guidovranken opened this issue Apr 21, 2023 · 4 comments

Comments

@guidovranken
Copy link
Contributor

Cryptofuzz keeps finding Go CVE-2023-24532:

https://oss-fuzz.com/testcase-detail/5161480428584960
https://oss-fuzz.com/testcase-detail/5552041199271936

Please update Go in the images to a newer version if possible.

@DavidKorczynski
Copy link
Collaborator

Ref: #9949

@AdamKorcz do you have some comments here?

I think it's been discussed in another thread, where the conclusion was a significant portion of the Golang projects integrated into OSS-Fuzz are not yet ready for the latest version of Golang. However, I think we can just bump the version Cryptofozz?

@DavidKorczynski
Copy link
Collaborator

However, I think we can just bump the version Cryptofozz?

Such as #10158

@AdamKorcz
Copy link
Collaborator

Ref: #9949

@AdamKorcz do you have some comments here?

I think it's been discussed in another thread, where the conclusion was a significant portion of the Golang projects integrated into OSS-Fuzz are not yet ready for the latest version of Golang. However, I think we can just bump the version Cryptofozz?

I agree. @guidovranken see here for a way to bump in Cryptofuzz:

RUN wget https://go.dev/dl/go1.20.2.linux-amd64.tar.gz \
&& mkdir temp-go \
&& rm -rf /root/.go/* \
&& tar -C temp-go/ -xzf go1.20.2.linux-amd64.tar.gz \
&& mv temp-go/go/* /root/.go/

@guidovranken
Copy link
Contributor Author

Thanks. Fixed via #10480

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants