Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"
MIME-Version: 1.0
Date: Fri, 26 Sep 2014 13:54:28 +0000
From: "Thomas Klausner" <wiz@netbsd.org>
Subject: CVS commit: pkgsrc/lang/go
To: pkgsrc-changes@NetBSD.org
Reply-To: wiz@netbsd.org
Message-Id: <20140926135428.9497A98@cvs.netbsd.org>
Sender: pkgsrc-changes-owner@NetBSD.org
Precedence: bulk

Module Name:	pkgsrc
Committed By:	wiz
Date:		Fri Sep 26 13:54:28 UTC 2014

Modified Files:
	pkgsrc/lang/go: Makefile PLIST distinfo

Log Message:
Update to 1.3.2 for a security fix:

We've just released Go version 1.3.2, a minor point release.

This release includes bug fixes to cgo and the crypto/tls package.
    https://golang.org/doc/devel/release.html#go1.3.minor

The crpyto/tls fix addresses a security bug that affects programs
that use crypto/tls to implement a TLS server from Go 1.1 onwards.
If the server enables TLS client authentication using certificates
(this is rare) and explicitly sets SessionTicketsDisabled to true
in the tls.Config, then a malicious client can falsely assert
ownership of any client certificate it wishes. This issue was
discovered internally and there is no evidence of exploitation.


To generate a diff of this commit:
cvs rdiff -u -r1.17 -r1.18 pkgsrc/lang/go/Makefile
cvs rdiff -u -r1.11 -r1.12 pkgsrc/lang/go/PLIST
cvs rdiff -u -r1.12 -r1.13 pkgsrc/lang/go/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.