From bc0f65857ef6cb3c82a364ebfa5867a3fa3bc350 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Fri, 13 Oct 2023 20:41:45 +0200 Subject: [PATCH] package/go: security bump to version 1.20.10 Fixes CVE-2023-39325: rapid stream resets can cause excessive work A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. go1.20.10 (released 2023-10-10) includes a security fix to the net/http package. Signed-off-by: Peter Korsgaard --- package/go/go.hash | 2 +- package/go/go.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/go/go.hash b/package/go/go.hash index ac603e6e3b..a4aafbe6e4 100644 --- a/package/go/go.hash +++ b/package/go/go.hash @@ -1,3 +1,3 @@ # From https://go.dev/dl -sha256 4923920381cd71d68b527761afefa523ea18c5831b4795034c827e18b685cdcf go1.20.9.src.tar.gz +sha256 72d2f51805c47150066c103754c75fddb2c19d48c9219fa33d1e46696c841dbb go1.20.10.src.tar.gz sha256 2d36597f7117c38b006835ae7f537487207d8ec407aa9d9980794b2030cbc067 LICENSE diff --git a/package/go/go.mk b/package/go/go.mk index cc374aa44f..c3f88b8682 100644 --- a/package/go/go.mk +++ b/package/go/go.mk @@ -4,7 +4,7 @@ # ################################################################################ -GO_VERSION = 1.20.9 +GO_VERSION = 1.20.10 GO_SITE = https://storage.googleapis.com/golang GO_SOURCE = go$(GO_VERSION).src.tar.gz