mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 21:37:23 +00:00
Sebastiaan van Stijn
81aa147181
go1.19.11 (released 2023-07-11) includes a security fix to the net/http package, as well as bug fixes to cgo, the cover tool, the go command, the runtime, and the go/printer package. See the Go 1.19.11 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.19.11+label%3ACherryPickApproved Full diff: https://github.com/golang/go/compare/go1.19.10...go1.19.11 These minor releases include 1 security fixes following the security policy: net/http: insufficient sanitization of Host header The HTTP/1 client did not fully validate the contents of the Host header. A maliciously crafted Host header could inject additional headers or entire requests. The HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. Thanks to Bartek Nowotarski for reporting this issue. Includes security fixes for [CVE-2023-29406 ][1] and Go issue https://go.dev/issue/60374 [1]: https://github.com/advisories/GHSA-f8f7-69v5-w4vx Signed-off-by: Sebastiaan van Stijn <github@gone.nl>