Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump go version to 1.11.13 #79

Merged
merged 1 commit into from
Aug 22, 2019

Conversation

LucasRoesler
Copy link
Member

@LucasRoesler LucasRoesler commented Aug 22, 2019

  • Using the base golang:1.11 docker image so that we can easily track
    security patches for go 1.11. In particular this includes go 1.11.13,
    which address

https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg

net/http: Denial of Service vulnerabilities in the HTTP/2 implementation

net/http and golang.org/x/net/http2 servers that accept direct connections
from untrusted clients could be remotely made to allocate an unlimited amount
of memory, until the program crashes. Servers will now close connections if
the send queue accumulates too many control messages.

net/url: parsing validation issue

url.Parse would accept URLs with malformed hosts, such that the Host field
could have arbitrary suffixes that would appear in neither Hostname() nor
Port(), allowing authorization bypasses in certain applications. Note that URLs
with invalid, not numeric ports will now return an error from url.Parse.

Motivation and Context

  • I have raised an issue to propose this change (required)

Resolves #78

How Has This Been Tested?

Built the image and then exec-ing the binary using

docker build -t openfaas/of-watchdog:build .
docker run --rm -it openfaas/of-watchdog:build ./of-watchdog -h

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I've read the CONTRIBUTION guide
  • I have signed-off my commits with git commit -s
  • I have added tests to cover my changes.
  • All new and existing tests passed.

**What**
- Using the base golang:1.11 docker image so that we can easily track
security patches for go 1.11. In particular this includes go 1.11.13,
which address

 https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg

> net/http: Denial of Service vulnerabilities in the HTTP/2 implementation
>
> net/http and golang.org/x/net/http2 servers that accept direct connections
> from untrusted clients could be remotely made to allocate an unlimited amount
> of memory, until the program crashes. Servers will now close connections if
> the send queue accumulates too many control messages.
>
> net/url: parsing validation issue
>
> url.Parse would accept URLs with malformed hosts, such that the Host field
> could have arbitrary suffixes that would appear in neither Hostname() nor
> Port(), allowing authorization bypasses in certain applications. Note that URLs
> with invalid, not numeric ports will now return an error from url.Parse.

Signed-off-by: Lucas Roesler <[email protected]>
Copy link
Member

@alexellis alexellis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@alexellis alexellis merged commit 0f3cbbc into openfaas:master Aug 22, 2019
@alexellis alexellis mentioned this pull request Jan 7, 2020
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update Docker build layer to go 1.11.13
2 participants