Sun Feb 2 09:26:39 2020 UTC ()
Update go112 to 1.12.16 (security release).

Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte

On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
functions of golang.org/x/crypto/cryptobyte can lead to a panic.

The malformed certificate can be delivered via a crypto/tls connection to a
client, or to a server that accepts client certificates. net/http clients can
be made to crash by an HTTPS server, while net/http servers that accept client
certificates will recover the panic and are unaffected.

Thanks to Project Wycheproof for providing the test cases that led to the
discovery of this issue.

The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.

This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of
golang.org/x/crypto/cryptobyte.


(bsiegert)
diff -r1.78 -r1.79 pkgsrc/lang/go/version.mk
diff -r1.10 -r1.11 pkgsrc/lang/go112/distinfo
cvs diff -r1.78 -r1.79 pkgsrc/lang/go/version.mk (expand / switch to unified diff)

--- pkgsrc/lang/go/version.mk 2020/01/10 12:56:35 1.78
+++ pkgsrc/lang/go/version.mk 2020/02/02 09:26:39 1.79
@@ -1,23 +1,23 @@ @@ -1,23 +1,23 @@
1# $NetBSD: version.mk,v 1.78 2020/01/10 12:56:35 bsiegert Exp $ 1# $NetBSD: version.mk,v 1.79 2020/02/02 09:26:39 bsiegert Exp $
2 2
3# 3#
4# If bsd.prefs.mk is included before go-package.mk in a package, then this 4# If bsd.prefs.mk is included before go-package.mk in a package, then this
5# file must be included directly in the package prior to bsd.prefs.mk. 5# file must be included directly in the package prior to bsd.prefs.mk.
6# 6#
7.include "go-vars.mk" 7.include "go-vars.mk"
8 8
9GO113_VERSION= 1.13.6 9GO113_VERSION= 1.13.6
10GO112_VERSION= 1.12.15 10GO112_VERSION= 1.12.16
11GO111_VERSION= 1.11.13 11GO111_VERSION= 1.11.13
12GO110_VERSION= 1.10.8 12GO110_VERSION= 1.10.8
13GO19_VERSION= 1.9.7 13GO19_VERSION= 1.9.7
14GO14_VERSION= 1.4.3 14GO14_VERSION= 1.4.3
15GO_VERSION= ${GO110_VERSION} 15GO_VERSION= ${GO110_VERSION}
16 16
17.include "../../mk/bsd.prefs.mk" 17.include "../../mk/bsd.prefs.mk"
18 18
19.if ${OPSYS} == "NetBSD" && ${OS_VERSION:M6.*} 19.if ${OPSYS} == "NetBSD" && ${OS_VERSION:M6.*}
20# 1.9 is the last Go version to support NetBSD 6 20# 1.9 is the last Go version to support NetBSD 6
21GO_VERSION_DEFAULT?= 19 21GO_VERSION_DEFAULT?= 19
22.elif ${OPSYS} == "Darwin" && ${OS_VERSION:R} < 14 22.elif ${OPSYS} == "Darwin" && ${OS_VERSION:R} < 14
23# go 1.11 removed support for osx 10.8 and 10.9 23# go 1.11 removed support for osx 10.8 and 10.9
cvs diff -r1.10 -r1.11 pkgsrc/lang/go112/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/go112/Attic/distinfo 2020/01/10 12:53:01 1.10
+++ pkgsrc/lang/go112/Attic/distinfo 2020/02/02 09:26:39 1.11
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1$NetBSD: distinfo,v 1.10 2020/01/10 12:53:01 bsiegert Exp $ 1$NetBSD: distinfo,v 1.11 2020/02/02 09:26:39 bsiegert Exp $
2 2
3SHA1 (go1.12.15.src.tar.gz) = 8f104d4718abe9e9301d6529bd83e2b7e2d3855e 3SHA1 (go1.12.16.src.tar.gz) = 4cc4b826a99268ae596e21447e2fe228baa2ef1b
4RMD160 (go1.12.15.src.tar.gz) = 26761a6ab380fd449e14d677b1b680c717284810 4RMD160 (go1.12.16.src.tar.gz) = 8c33946ad3892c6f9f0de01c1875fa41d23dc0e6
5SHA512 (go1.12.15.src.tar.gz) = 887e331c73b9d174e4a707a85be389fa0de43c77bc191ef5e0fe326ac7285374404450ca081cb8e92514a973d25d0314ca74eb17c8e53f8386e1798edd9d41aa 5SHA512 (go1.12.16.src.tar.gz) = 715f9c10ff06a5475cf49a621e97df93808e42e48f534ca1a3377115a553e183f76b5277f2673bf5d418430c94efb35d87ebe0c63976ae71743997fe76a2598c
6Size (go1.12.15.src.tar.gz) = 20726294 bytes 6Size (go1.12.16.src.tar.gz) = 20725779 bytes
7SHA1 (patch-misc_io_clangwrap.sh) = cd91c47ba0fe7b6eb8009dd261c0c26c7d581c29 7SHA1 (patch-misc_io_clangwrap.sh) = cd91c47ba0fe7b6eb8009dd261c0c26c7d581c29
8SHA1 (patch-src_cmd_dist_util.go) = 24e6f1b6ded842a8ce322a40e8766f7d344bc47e 8SHA1 (patch-src_cmd_dist_util.go) = 24e6f1b6ded842a8ce322a40e8766f7d344bc47e
9SHA1 (patch-src_cmd_link_internal_ld_elf.go) = 990a54e3baf239916e4c7f0c1d54240e2898601a 9SHA1 (patch-src_cmd_link_internal_ld_elf.go) = 990a54e3baf239916e4c7f0c1d54240e2898601a
10SHA1 (patch-src_cmd_vendor_golang.org_x_sys_unix_sockcmsg__unix.go) = 893b70c73cf9d1a33483c3c1d886a88122e5619c 10SHA1 (patch-src_cmd_vendor_golang.org_x_sys_unix_sockcmsg__unix.go) = 893b70c73cf9d1a33483c3c1d886a88122e5619c
11SHA1 (patch-src_crypto_x509_root__bsd.go) = 93a2de7c685a0919fe93f5bc99f156e105dace4d 11SHA1 (patch-src_crypto_x509_root__bsd.go) = 93a2de7c685a0919fe93f5bc99f156e105dace4d
12SHA1 (patch-src_runtime_os__netbsd.go) = 9b80de94667e3f8d8d1ae3648ab1fe43dd55d577 12SHA1 (patch-src_runtime_os__netbsd.go) = 9b80de94667e3f8d8d1ae3648ab1fe43dd55d577
13SHA1 (patch-src_syscall_sockcmsg__unix.go) = c0da2679cf8152e9ecce983b5c6d790bec3af390 13SHA1 (patch-src_syscall_sockcmsg__unix.go) = c0da2679cf8152e9ecce983b5c6d790bec3af390
14SHA1 (patch-src_syscall_zsysnum__solaris__amd64.go) = ec28a0fa37ba9599ec1651c8e9337a2efc48a26b 14SHA1 (patch-src_syscall_zsysnum__solaris__amd64.go) = ec28a0fa37ba9599ec1651c8e9337a2efc48a26b