Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[cherry-pick] Bump Go version - fix vulnerability in the std lib #5930

Conversation

nginx-bot
Copy link
Contributor

Proposed changes

This PR bumps Go version to 1.22.5. It fixes GO-2024-2963 vulnerability.

➜  kubernetes-ingress git:(chore/vuln-fix) ✗ govulncheck ./...
=== Symbol Results ===

Vulnerability #1: GO-2024-2963
    Denial of service due to improper 100-continue handling in net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2963
  Standard library
    Found in: net/http@go1.22.4
    Fixed in: net/http@go1.22.5
    Example traces found:
      #1: internal/nginx/verify.go:48:26: nginx.verifyClient.GetConfigVersion calls http.Client.Do

Your code is affected by 1 vulnerability from the Go standard library.
This scan found no other vulnerabilities in packages you import or modules you
require.

After the change:

➜  kubernetes-ingress git:(chore/vuln-fix) govulncheck -show verbose,version ./...
Go: go1.22.5
Scanner: govulncheck@v1.1.2
DB: https://vuln.go.dev
DB updated: 2024-07-02 20:11:00 +0000 UTC

Scanning your code and 1073 packages across 100 dependent modules for known vulnerabilities...

Fetching vulnerabilities from the database...

Checking the code against the vulnerabilities...

No vulnerabilities found.

Checklist

Before creating a PR, run through this checklist and mark each as complete.

  • I have read the CONTRIBUTING doc
  • I have added tests that prove my fix is effective or that my feature works
  • I have checked that all unit tests pass after adding my changes
  • I have updated necessary documentation
  • I have rebased my branch onto main
  • I will ensure my PR is targeting the main branch and pulling from my branch from my own fork

@nginx-bot nginx-bot requested a review from a team as a code owner July 3, 2024 08:13
@nginx-bot nginx-bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 3, 2024
@pdabelf5 pdabelf5 enabled auto-merge (squash) July 3, 2024 08:15
@pdabelf5 pdabelf5 merged commit 7a37585 into release-3.6 Jul 3, 2024
65 checks passed
@pdabelf5 pdabelf5 deleted the cherry-pick-release-3.6-777ad2df05b8d140abbe38227fa4f5b28bccd8c3 branch July 3, 2024 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

7 participants