Packer-Cn/.go-version at plugins_remove_local_path_support - Packer-Cn - SharkDat Src

iSharkFly-Docs/Packer-Cn

mirror of https://github.com/hashicorp/packer.git synced 2026-09-21 07:21:40 -04:00

Files

T

Wilken Rivera e3c8d9b929 Bump Go toolchain to 1.21.8

This change addresses vulnerabilities reported by govulncheck

```
Vulnerability #1: GO-2024-2610
    Errors returned from JSON marshaling may break template escaping in
    html/template
  More info: https://pkg.go.dev/vuln/GO-2024-2610
  Standard library
    Found in: html/[email protected]
    Fixed in: html/[email protected].1
    Example traces found:
      #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.Execute
      #2: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.ExecuteTemplate

Vulnerability #2: GO-2024-2600
    Incorrect forwarding of sensitive headers and cookies on HTTP redirect in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2600
  Standard library
    Found in: net/[email protected]
    Fixed in: net/[email protected].1
    Example traces found:
      #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do
      #2: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.Post
      #3: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.PostForm

Vulnerability #3: GO-2024-2599
    Memory exhaustion in multipart form parsing in net/textproto and net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2599
  Standard library
    Found in: net/[email protected]
    Fixed in: net/[email protected].1
    Example traces found:
      #1: internal/hcp/api/service_build.go:81:48: api.Client.UpdateBuild calls packer_service.Client.PackerServiceUpdateBuild, which eventually calls textproto.Reader.ReadLine
      #2: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #4: GO-2024-2598
    Verify panics on certificates with an unknown public key algorithm in
    crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2024-2598
  Standard library
    Found in: crypto/[email protected]
    Fixed in: crypto/[email protected].1
    Example traces found:
      #1: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls x509.Certificate.Verify

```

2024-03-06 11:23:45 -05:00

2 lines

7 B

Plaintext

Raw Permalink Blame History

1.21.8