---
- branch: MAIN
  date: Fri Oct  6 18:38:25 UTC 2017
  files:
  - new: '1.52'
    old: '1.51'
    path: pkgsrc/lang/go/distinfo
    pathrev: pkgsrc/lang/go/distinfo@1.52
    type: modified
  - new: '1.29'
    old: '1.28'
    path: pkgsrc/lang/go/version.mk
    pathrev: pkgsrc/lang/go/version.mk@1.29
    type: modified
  id: 20171006T183825Z.166bd0b3d4668f532005d6a0162f9b795d557d87
  log: |
    Update Go to 1.9.1 (security fix).

    Two security-related issues were recently reported.
    To address this issue, we have just released Go 1.8.4 and Go 1.9.1.

    We recommend that all users update to one of these releases (if you're not sure
    which, choose Go 1.9.1).

    The issues addressed by these releases are:

    By nesting a git checkout inside another version control repository, it was
    possible for an attacker to trick the "go get" command into executing arbitrary
    code. The go command now refuses to use version control checkouts found inside
    other version control systems, with an exception for git submodules (git inside
    git).
    The issue is tracked as https://golang.org/issue/22125 (Go 1.8.4) and
    https://golang.org/issue/22131 (Go 1.9.1). Fixes are linked from the issues.
    Thanks to Simon Rawet for the report.

    In the smtp package, PlainAuth is documented as sending credentials only over
    authenticated, encrypted TLS connections, but it was changed in Go 1.1 to also
    send credentials on non-TLS connections when the remote server advertises that
    PLAIN authentication is supported. The change was meant to allow use of PLAIN
    authentication on localhost, but it has the effect of allowing a
    man-in-the-middle attacker to harvest credentials. PlainAuth now requires
    either TLS or a localhost connection before sending credentials, regardless of
    what the remote server claims.
    This issue is tracked as https://golang.org/issue/22134 (Go 1.8.4) and
    https://golang.org/issue/22133 (Go 1.9.1). Fixes are linked from the issues.
    Thanks to Stevie Johnstone for the report.
  module: pkgsrc
  subject: 'CVS commit: pkgsrc/lang/go'
  unixtime: '1507315105'
  user: bsiegert