[Buildroot] [PATCH v1 1/1] package/go: security bump version to go1.22.3

[Buildroot] [PATCH v1 1/1] package/go: security bump version to go1.22.3

[Christian Stewart via buildroot]

Fixes CVEs:

CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin
CVE-2024-24788: net: malformed DNS message can cause infinite loop

https://go.dev/doc/devel/release#go1.22.3

Signed-off-by: Christian Stewart <christian@aperture.us>
---
 package/go/go.hash | 2 +-
 package/go/go.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/go/go.hash b/package/go/go.hash
index 81bd14baa8..6bbde5b589 100644
--- a/package/go/go.hash
+++ b/package/go/go.hash
@@ -1,3 +1,3 @@
 # From https://go.dev/dl
-sha256  374ea82b289ec738e968267cac59c7d5ff180f9492250254784b2044e90df5a9  go1.22.2.src.tar.gz
+sha256  80648ef34f903193d72a59c0dff019f5f98ae0c9aa13ade0b0ecbff991a76f68  go1.22.3.src.tar.gz
 sha256  2d36597f7117c38b006835ae7f537487207d8ec407aa9d9980794b2030cbc067  LICENSE
diff --git a/package/go/go.mk b/package/go/go.mk
index 0e39ad9f8c..43dfe1eae5 100644
--- a/package/go/go.mk
+++ b/package/go/go.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GO_VERSION = 1.22.2
+GO_VERSION = 1.22.3
 GO_SITE = https://storage.googleapis.com/golang
 GO_SOURCE = go$(GO_VERSION).src.tar.gz
 
-- 
2.43.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v1 1/1] package/go: security bump version to go1.22.3

[Thomas Petazzoni via buildroot]

On Tue,  7 May 2024 14:42:34 -0700
Christian Stewart via buildroot <buildroot@buildroot.org> wrote:

> Fixes CVEs:
> 
> CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin
> CVE-2024-24788: net: malformed DNS message can cause infinite loop
> 
> https://go.dev/doc/devel/release#go1.22.3
> 
> Signed-off-by: Christian Stewart <christian@aperture.us>
> ---
>  package/go/go.hash | 2 +-
>  package/go/go.mk   | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v1 1/1] package/go: security bump version to go1.22.3

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Petazzoni via buildroot <buildroot@buildroot.org> writes:

 > On Tue,  7 May 2024 14:42:34 -0700
 > Christian Stewart via buildroot <buildroot@buildroot.org> wrote:

 >> Fixes CVEs:
 >> 
 >> CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin
 >> CVE-2024-24788: net: malformed DNS message can cause infinite loop
 >> 
 >> https://go.dev/doc/devel/release#go1.22.3
 >> 
 >> Signed-off-by: Christian Stewart <christian@aperture.us>
 >> ---
 >> package/go/go.hash | 2 +-
 >> package/go/go.mk   | 2 +-
 >> 2 files changed, 2 insertions(+), 2 deletions(-)

 > Applied to master, thanks.

For 2024.02.x I have instead bumped to 1.21.10.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot