---
- branch: MAIN
  date: Wed Jul 13 15:02:03 UTC 2022
  files:
  - new: '1.153'
    old: '1.152'
    path: pkgsrc/lang/go/version.mk
    pathrev: pkgsrc/lang/go/version.mk@1.153
    type: modified
  - new: '1.4'
    old: '1.3'
    path: pkgsrc/lang/go118/Makefile
    pathrev: pkgsrc/lang/go118/Makefile@1.4
    type: modified
  - new: '1.5'
    old: '1.4'
    path: pkgsrc/lang/go118/PLIST
    pathrev: pkgsrc/lang/go118/PLIST@1.5
    type: modified
  - new: '1.5'
    old: '1.4'
    path: pkgsrc/lang/go118/distinfo
    pathrev: pkgsrc/lang/go118/distinfo@1.5
    type: modified
  id: 20220713T150203Z.42f9afc91ed19b1a0fdbb76d12bc7ee5444cfe18
  log: |
    go118: update to 1.18.4 (security update)

    This minor release includes 9 security fixes following the security policy:

    net/http: improper sanitization of Transfer-Encoding header

    The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating
    a "chunked" encoding. This could potentially allow for request smuggling, but
    only if combined with an intermediate server that also improperly failed to
    reject the header as invalid.

    This is CVE-2022-1705 and https://go.dev/issue/53188.

    When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map
    containing a nil value for the X-Forwarded-For header, ReverseProxy would set
    the client IP as the value of the X-Forwarded-For header, contrary to its
    documentation. In the more usual case where a Director function set the
    X-Forwarded-For header value to nil, ReverseProxy would leave the header
    unmodified as expected.

    This is https://go.dev/issue/53423 and CVE-2022-32148.

    Thanks to Christian Mehlmauer for reporting this issue.

    compress/gzip: stack exhaustion in Reader.Read

    Calling Reader.Read on an archive containing a large number of concatenated
    0-length compressed files can cause a panic due to stack exhaustion.

    This is CVE-2022-30631 and Go issue https://go.dev/issue/53168.

    encoding/xml: stack exhaustion in Unmarshal

    Calling Unmarshal on a XML document into a Go struct which has a nested field
    that uses the any field tag can cause a panic due to stack exhaustion.

    This is CVE-2022-30633 and Go issue https://go.dev/issue/53611.

    encoding/xml: stack exhaustion in Decoder.Skip

    Calling Decoder.Skip when parsing a deeply nested XML document can cause a
    panic due to stack exhaustion.

    The Go Security team discovered this issue, and it was independently reported
    by Juho Nurminen of Mattermost.

    This is CVE-2022-28131 and Go issue https://go.dev/issue/53614.

    encoding/gob: stack exhaustion in Decoder.Decode

    Calling Decoder.Decode on a message which contains deeply nested structures can
    cause a panic due to stack exhaustion.

    This is CVE-2022-30635 and Go issue https://go.dev/issue/53615.

    path/filepath: stack exhaustion in Glob

    Calling Glob on a path which contains a large number of path separators can
    cause a panic due to stack exhaustion.

    Thanks to Juho Nurminen of Mattermost for reporting this issue.

    This is CVE-2022-30632 and Go issue https://go.dev/issue/53416.

    io/fs: stack exhaustion in Glob

    Calling Glob on a path which contains a large number of path separators can
    cause a panic due to stack exhaustion.

    This is CVE-2022-30630 and Go issue https://go.dev/issue/53415.

    go/parser: stack exhaustion in all Parse* functions

    Calling any of the Parse functions on Go source code which contains deeply
    nested types or declarations can cause a panic due to stack exhaustion.

    Thanks to Juho Nurminen of Mattermost for reporting this issue.

    This is CVE-2022-1962 and Go issue https://go.dev/issue/53616.
  module: pkgsrc
  subject: 'CVS commit: pkgsrc/lang'
  unixtime: '1657724523'
  user: bsiegert