mirror of
https://github.com/docker/cli.git
synced 2026-10-28 08:19:40 +03:00
2d5d0842c5
go1.25.7 (released 2026-02-04) includes security fixes to the go command and the crypto/tls package, as well as bug fixes to the compiler and the crypto/x509 package. See the Go 1.25.7 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.25.7+label%3ACherryPickApproved full diff: https://github.com/golang/go/compare/go1.25.6...go1.25.7 From the security mailing list: > Hello gophers, > > We have just released Go versions 1.25.7 and 1.24.13, minor point releases. > > These releases include 2 security fixes following the security policy: > > - cmd/cgo: remove user-content from doc strings in cgo ASTs > > A discrepancy between how Go and C/C++ comments > were parsed allowed for code smuggling into the > resulting cgo binary. > > To prevent this behavior, the cgo compiler > will no longer parse user-provided doc > comments. > > Thank you to RyotaK (https://ryotak.net) of > GMO Flatt Security Inc. for reporting this issue. > > This is CVE-2025-61732 and https://go.dev/issue/76697. > > - crypto/tls: unexpected session resumption when using Config.GetConfigForClient > > Config.GetConfigForClient is documented to use the original Config's session > ticket keys unless explicitly overridden. This can cause unexpected behavior if > the returned Config modifies authentication parameters, like ClientCAs: a > connection initially established with the parent (or a sibling) Config can be > resumed, bypassing the modified authentication requirements. > > If ClientAuth is VerifyClientCertIfGiven or RequireAndVerifyClientCert (on the > server) or InsecureSkipVerify is false (on the client), crypto/tls now checks > that the root of the previously-verified chain is still in ClientCAs/RootCAs > when resuming a connection. > > Go 1.26 Release Candidate 2, Go 1.25.6, and Go 1.24.12 had fixed a similar issue > related to session ticket keys being implicitly shared by Config.Clone. Since > this fix is broader, the Config.Clone behavior change has been reverted. > > Note that VerifyPeerCertificate still behaves as documented: it does not apply > to resumed connections. Applications that use Config.GetConfigForClient or > Config.Clone and do not wish to blindly resume connections established with the > original Config must use VerifyConnection instead (or SetSessionTicketKeys or > SessionTicketsDisabled). > > Thanks to Coia Prant (github.com/rbqvq) for reporting this issue. > > This updates CVE-2025-68121 and Go issue https://go.dev/issue/77217. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
80 lines
2.3 KiB
YAML
80 lines
2.3 KiB
YAML
name: codeql
|
|
|
|
# Default to 'contents: read', which grants actions to read commits.
|
|
#
|
|
# If any permission is set, any permission not included in the list is
|
|
# implicitly set to "none".
|
|
#
|
|
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- '[0-9]+.[0-9]+'
|
|
- '[0-9]+.x'
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
# The branches below must be a subset of the branches above
|
|
branches: ["master"]
|
|
schedule:
|
|
# ┌───────────── minute (0 - 59)
|
|
# │ ┌───────────── hour (0 - 23)
|
|
# │ │ ┌───────────── day of the month (1 - 31)
|
|
# │ │ │ ┌───────────── month (1 - 12)
|
|
# │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday)
|
|
# │ │ │ │ │
|
|
# │ │ │ │ │
|
|
# │ │ │ │ │
|
|
# * * * * *
|
|
- cron: '0 9 * * 4'
|
|
|
|
jobs:
|
|
codeql:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
env:
|
|
DISABLE_WARN_OUTSIDE_CONTAINER: '1'
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 2
|
|
# CodeQL 2.16.4's auto-build added support for multi-module repositories,
|
|
# and is trying to be smart by searching for modules in every directory,
|
|
# including vendor directories. If no module is found, it's creating one
|
|
# which is ... not what we want, so let's give it a "go.mod".
|
|
# see: https://github.com/docker/cli/pull/4944#issuecomment-2002034698
|
|
-
|
|
name: Create go.mod
|
|
run: |
|
|
ln -s vendor.mod go.mod
|
|
ln -s vendor.sum go.sum
|
|
-
|
|
name: Update Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: "1.25.7"
|
|
-
|
|
name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: go
|
|
-
|
|
name: Autobuild
|
|
uses: github/codeql-action/autobuild@v4
|
|
-
|
|
name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v4
|
|
with:
|
|
category: "/language:go"
|