CVS commit: pkgsrc/lang

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Tue Mar  5 19:27:59 UTC 2024

Modified Files:
        pkgsrc/lang/go: version.mk
        pkgsrc/lang/go121: PLIST distinfo

Log Message:
go121: update to 1.21.8 (security)

This minor release includes 5 security fixes following the security policy:

- crypto/x509: Verify panics on certificates with an unknown public key
  algorithm

  Verifying a certificate chain which contains a certificate with an unknown
  public key algorithm will cause Certificate.Verify to panic.

  This affects all crypto/tls clients, and servers that set Config.ClientAuth
  to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default
  behavior is for TLS servers to not verify client certificates.

  Thanks to John Howard (Google) for reporting this issue.

  This is CVE-2024-24783 and Go issue https://go.dev/issue/65390.

- net/http: memory exhaustion in Request.ParseMultipartForm

  When parsing a multipart form (either explicitly with
  Request.ParseMultipartForm or implicitly with Request.FormValue,
  Request.PostFormValue, or Request.FormFile), limits on the total size of the
  parsed form were not applied to the memory consumed while reading a single
  form line. This permitted a maliciously crafted input containing very long
  lines to cause allocation of arbitrarily large amounts of memory, potentially
  leading to memory exhaustion.

  ParseMultipartForm now correctly limits the maximum size of form lines.

  Thanks to Bartek Nowotarski for reporting this issue.

  This is CVE-2023-45290 and Go issue https://go.dev/issue/65383.

- net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and
  cookies on HTTP redirect

  When following an HTTP redirect to a domain which is not a subdomain match or
  exact match of the initial domain, an http.Client does not forward sensitive
  headers such as "Authorization" or "Cookie". For example, a redirect from
  foo.com to www.foo.com will forward the Authorization header, but a redirect
  to bar.com will not.

  A maliciously crafted HTTP redirect could cause sensitive headers to be
  unexpectedly forwarded.

  Thanks to Juho Nurminen of Mattermost for reporting this issue.

  This is CVE-2023-45289 and Go issue https://go.dev/issue/65065.

- html/template: errors returned from MarshalJSON methods may break template
  escaping

  If errors returned from MarshalJSON methods contain user controlled data,
  they may be used to break the contextual auto-escaping behavior of the
  html/template package, allowing for subsequent actions to inject unexpected
  content into templates.

  Thanks to RyotaK (https://ryotak.net) for reporting this issue.

  This is CVE-2024-24785 and Go issue https://go.dev/issue/65697.

- net/mail: comments in display names are incorrectly handled

  The ParseAddressList function incorrectly handles comments (text within
  parentheses) within display names. Since this is a misalignment with
  conforming address parsers, it can result in different trust decisions being
  made by programs using different parsers.

  Thanks to Juho Nurminen of Mattermost and Slonser
  (https://github.com/Slonser) for reporting this issue.

  This is CVE-2024-24784 and Go issue https://go.dev/issue/65083.


To generate a diff of this commit:
cvs rdiff -u -r1.202 -r1.203 pkgsrc/lang/go/version.mk
cvs rdiff -u -r1.7 -r1.8 pkgsrc/lang/go121/PLIST
cvs rdiff -u -r1.8 -r1.9 pkgsrc/lang/go121/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/lang/go/version.mk
diff -u pkgsrc/lang/go/version.mk:1.202 pkgsrc/lang/go/version.mk:1.203
--- pkgsrc/lang/go/version.mk:1.202     Fri Feb  9 20:34:10 2024
+++ pkgsrc/lang/go/version.mk   Tue Mar  5 19:27:58 2024
@@ -1,4 +1,4 @@
-# $NetBSD: version.mk,v 1.202 2024/02/09 20:34:10 bsiegert Exp $
+# $NetBSD: version.mk,v 1.203 2024/03/05 19:27:58 bsiegert Exp $
 
 #
 # If bsd.prefs.mk is included before go-package.mk in a package, then this
@@ -7,7 +7,7 @@
 .include "go-vars.mk"
 
 GO122_VERSION= 1.22.0
-GO121_VERSION= 1.21.7
+GO121_VERSION= 1.21.8
 GO120_VERSION= 1.20.14
 GO119_VERSION= 1.19.13
 GO118_VERSION= 1.18.10

Index: pkgsrc/lang/go121/PLIST
diff -u pkgsrc/lang/go121/PLIST:1.7 pkgsrc/lang/go121/PLIST:1.8
--- pkgsrc/lang/go121/PLIST:1.7 Wed Feb  7 14:44:16 2024
+++ pkgsrc/lang/go121/PLIST     Tue Mar  5 19:27:58 2024
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.7 2024/02/07 14:44:16 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.8 2024/03/05 19:27:58 bsiegert Exp $
 bin/go${GOVERSSUFFIX}
 bin/gofmt${GOVERSSUFFIX}
 go121/CONTRIBUTING.md
@@ -2604,6 +2604,7 @@ go121/src/cmd/go/testdata/script/mod_ven
 go121/src/cmd/go/testdata/script/mod_vendor_unused.txt
 go121/src/cmd/go/testdata/script/mod_vendor_unused_only.txt
 go121/src/cmd/go/testdata/script/mod_verify.txt
+go121/src/cmd/go/testdata/script/mod_verify_work.txt
 go121/src/cmd/go/testdata/script/mod_versions.txt
 go121/src/cmd/go/testdata/script/mod_why.txt
 go121/src/cmd/go/testdata/script/modfile_flag.txt

Index: pkgsrc/lang/go121/distinfo
diff -u pkgsrc/lang/go121/distinfo:1.8 pkgsrc/lang/go121/distinfo:1.9
--- pkgsrc/lang/go121/distinfo:1.8      Wed Feb  7 14:44:16 2024
+++ pkgsrc/lang/go121/distinfo  Tue Mar  5 19:27:58 2024
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.8 2024/02/07 14:44:16 bsiegert Exp $
+$NetBSD: distinfo,v 1.9 2024/03/05 19:27:58 bsiegert Exp $
 
-BLAKE2s (go1.21.7.src.tar.gz) = d37dd21c3f74340e16581e89017c653ae36001bc5ce8f4c8e0e33ba27c177b56
-SHA512 (go1.21.7.src.tar.gz) = 5cadc458265deea2650fbbc5b0652e19e858fa7a7b929ea717e82ee4be2af45214a9dfc5b8b799003e83b92aa80141962a472d1d4f0653e97e99df5b68c88e5d
-Size (go1.21.7.src.tar.gz) = 26991014 bytes
+BLAKE2s (go1.21.8.src.tar.gz) = 3f63992ded6331b1c43b5a7acbb9c636600e750dc40ad159815e62bb366f51e5
+SHA512 (go1.21.8.src.tar.gz) = dde764ee12fbf58a603d31c20ea239805ffec359a90b0aad7575cc857e241393c2adc47d2f00136db5dff2cbe11b90e8d009d67f9329d363e75a0720067123b0
+Size (go1.21.8.src.tar.gz) = 26992984 bytes
 SHA1 (patch-misc_ios_clangwrap.sh) = 0a06403609cb7bce2e6f65444fd322f486761afe
 SHA1 (patch-src_cmd_dist_build.go) = cbb9576f832806b0cbef121ea38ba6a54db95bc3
 SHA1 (patch-src_crypto_x509_root__bsd.go) = 0b5dead901450967109303f873a2696c65ccac35