Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of Upgrade to go 1.21.8 into release/1.4.x #3753

Merged
merged 2 commits into from
Mar 18, 2024
Merged

Backport of Upgrade to go 1.21.8 into release/1.4.x #3753

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8c34232
backport of commit a860f16f97d40521de5f4347ff7ee3db1b102e11
Mar 14, 2024
06af090
backport of commit 81746326794a903d27cf5152a43fc931e7b52e3f
Mar 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .changelog/3741.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
```release-note:security
Upgrade to use Go `1.21.8`. This resolves CVEs
[CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783) (`crypto/x509`).
[CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290) (`net/http`).
[CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289) (`net/http`, `net/http/cookiejar`).
[CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785) (`html/template`).
[CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784) (`net/mail`).
```

```release-note:security
Update the Consul Build Go base image to `alpine3.19`. This resolves CVEs
[CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425)
[CVE-2023-52426⁠](https://nvd.nist.gov/vuln/detail/CVE-2023-52426)
```
2 changes: 1 addition & 1 deletion .go-version
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.21.7
1.21.8
2 changes: 1 addition & 1 deletion control-plane/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
# go-discover builds the discover binary (which we don't currently publish
# either).
ARG GOLANG_VERSION
FROM golang:${GOLANG_VERSION}-alpine as go-discover
FROM golang:${GOLANG_VERSION}-alpine3.19 as go-discover
RUN CGO_ENABLED=0 go install github.com/hashicorp/go-discover/cmd/discover@214571b6a5309addf3db7775f4ee8cf4d264fd5f

# dev copies the binary from a local build
Expand Down
Loading