go1.19.9 (released 2023-05-02) includes three security fixes to the html/template
package, as well as bug fixes to the compiler, the runtime, and the crypto/tls
and syscall packages. See the Go 1.19.9 milestone on our issue tracker for details.
https://github.com/golang/go/issues?q=milestone%3AGo1.19.9+label%3ACherryPickApproved
release notes: https://go.dev/doc/devel/release#go1.19.9
full diff: https://github.com/golang/go/compare/go1.19.8...go1.19.9
from the announcement:
> These minor releases include 3 security fixes following the security policy:
>
>- html/template: improper sanitization of CSS values
>
> Angle brackets (`<>`) were not considered dangerous characters when inserted
> into CSS contexts. Templates containing multiple actions separated by a '/'
> character could result in unexpectedly closing the CSS context and allowing
> for injection of unexpected HMTL, if executed with untrusted input.
>
> Thanks to Juho Nurminen of Mattermost for reporting this issue.
>
> This is CVE-2023-24539 and Go issue https://go.dev/issue/59720.
>
> - html/template: improper handling of JavaScript whitespace
>
> Not all valid JavaScript whitespace characters were considered to be
> whitespace. Templates containing whitespace characters outside of the character
> set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain
> actions may not be properly sanitized during execution.
>
> Thanks to Juho Nurminen of Mattermost for reporting this issue.
>
> This is CVE-2023-24540 and Go issue https://go.dev/issue/59721.
>
> - html/template: improper handling of empty HTML attributes
>
> Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}")
> executed with empty input could result in output that would have unexpected
> results when parsed due to HTML normalization rules. This may allow injection
> of arbitrary attributes into tags.
>
> Thanks to Juho Nurminen of Mattermost for reporting this issue.
>
> This is CVE-2023-29400 and Go issue https://go.dev/issue/59722.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Signed-off-by: Chris Chinchilla <chris.ward@docker.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit e693e7f3b4)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The --format=json option was added for all inspect commands, but was not
implemented for "docker version". This patch implements the missing option.
Before this patch:
docker version --format=json
json
With this patch:
docker version --format=json
{"Client":{"Platform":{"Name":""},"Version":"24.0.0-dev","ApiVersion":"..."}}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 23bd746c43)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The --format=json option was added for all inspect commands, but was not implemented
for "docker info". This patch implements the missing option.
Before this patch:
docker info --format=json
json
With this patch applied:
docker info --format=json
{"ID":"80c2f18a-2c88-4e4a-ba69-dca0eea59835","Containers":7,"ContainersRunning":"..."}
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 46234b82e2)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
These tests were deliberately producing errors as part of the test, but
printing those errors could be confusing / make it more difficult to find
actual test-failures.
Before this patch:
=== RUN TestVolumeCreateErrors
Error: conflicting options: either specify --name or provide positional arg, not both
Error: "create" requires at most 1 argument.
See 'create --help'.
Usage: create [OPTIONS] [VOLUME] [flags]
Create a volume
Error: error creating volume
--- PASS: TestVolumeCreateErrors (0.00s)
PASS
With this patch applied:
=== RUN TestVolumeCreateErrors
--- PASS: TestVolumeCreateErrors (0.00s)
PASS
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit db827d583b)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This fixes the cli erroring out if the variable is set to an empty
value.
```
$ export DOCKER_BUILDKIT=
$ docker version
DOCKER_BUILDKIT environment variable expects boolean value: strconv.ParseBool: parsing "": invalid syntax
```
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit ff7f76af7a)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Adds documentation for the options that were added in
427c7cc5f8
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit c846428cb6)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The daemon no longer adjusts its oom-score by default; see
- 2b8e68ef06
- cf7a5be0f2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit c730a8eb95)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Update the description for the changes made in;
68e96f88ee
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit c209743612)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Adding a description based on the Go documentation.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 3701748000)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
No need to mention that the env-var may be removed at that point to keep
the description more to-the-point.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 879e0804a4)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Support for this environment variable was removed in docker 23.0 in
1240f8b41d
From that patch:
> All regular, non-EOL Linux distros now come with more recent kernels
> out of the box. There may still be users trying to run on kernel 3.10
> or older (some embedded systems, e.g.), but those should be a rare
> exception, which we don't have to take into account.
>
> This patch removes the kernel version check on Linux, and the corresponding
> DOCKER_NOWARN_KERNEL_VERSION environment that was there to skip this
> check.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 4a863df57a)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This function no longer uses the /info endpoint to resolve the registry
to use. The documentation for this function was still referring to
the (once used) special registry for Windows images, which is no longer
in use, so update the docs to reflect reality :)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 5bd359132b)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The next release will be "v24.0.0", not "v23.1.0"
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 04df700257)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- migrate away from things deprecated in Go 1.20 (removes use of archive/tar.TypeRegA)
full diff: https://github.com/docker/docker/compare/v23.0.1...v23.0.2
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit a39958846d)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Sebastiaan van Stijn
Sebastiaan van Stijn
Chris Chinchilla
dependabot[bot]
David Karlsson
Paweł Gronowski