mirror of
https://github.com/moby/moby.git
synced 2026-08-10 01:49:04 +00:00
38c0abffce
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5
This minor releases include 1 security fixes following the security policy:
- cmd/go: unexpected command execution in untrusted VCS repositories
Various uses of the Go toolchain in untrusted VCS repositories can result in
unexpected code execution. When using the Go toolchain in directories fetched
using various VCS tools (such as directly cloning Git or Mercurial repositories)
can cause the toolchain to execute unexpected commands, if said directory
contains multiple VCS configuration metadata (such as a '.hg' directory in a Git
repository). This is due to how the Go toolchain attempts to resolve which VCS
is being used in order to embed build information in binaries and determine
module versions.
The toolchain will now abort attempting to resolve which VCS is being used if it
detects multiple VCS configuration metadata in a module directory or nested VCS
configuration metadata (such as a '.git' directoy in a parent directory and a
'.hg' directory in a child directory). This will not prevent the toolchain from
building modules, but will result in binaries omitting VCS related build
information.
If this behavior is expected by the user, the old behavior can be re-enabled by
setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted
repositories.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting
this issue.
This is CVE-2025-4674 and https://go.dev/issue/74380.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.24.5
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit 0a047e825c)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
72 lines
2.3 KiB
YAML
72 lines
2.3 KiB
YAML
name: codeql
|
|
|
|
# Default to 'contents: read', which grants actions to read commits.
|
|
#
|
|
# If any permission is set, any permission not included in the list is
|
|
# implicitly set to "none".
|
|
#
|
|
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- '[0-9]+.[0-9]+'
|
|
- '[0-9]+.x'
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
# The branches below must be a subset of the branches above
|
|
branches: ["master"]
|
|
schedule:
|
|
# ┌───────────── minute (0 - 59)
|
|
# │ ┌───────────── hour (0 - 23)
|
|
# │ │ ┌───────────── day of the month (1 - 31)
|
|
# │ │ │ ┌───────────── month (1 - 12)
|
|
# │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday)
|
|
# │ │ │ │ │
|
|
# │ │ │ │ │
|
|
# │ │ │ │ │
|
|
# * * * * *
|
|
- cron: '0 9 * * 4'
|
|
|
|
jobs:
|
|
codeql:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 2
|
|
# CodeQL 2.16.4's auto-build added support for multi-module repositories,
|
|
# and is trying to be smart by searching for modules in every directory,
|
|
# including vendor directories. If no module is found, it's creating one
|
|
# which is ... not what we want, so let's give it a "go.mod".
|
|
# see: https://github.com/docker/cli/pull/4944#issuecomment-2002034698
|
|
- name: Create go.mod
|
|
run: |
|
|
ln -s vendor.mod go.mod
|
|
ln -s vendor.sum go.sum
|
|
- name: Update Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.24.5"
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v3
|
|
with:
|
|
languages: go
|
|
- name: Autobuild
|
|
uses: github/codeql-action/autobuild@v3
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v3
|
|
with:
|
|
category: "/language:go"
|