Log message:
go: update to 1.21.13 and 1.22.6

go1.21.13 (released 2024-08-06) includes fixes to the go command, the covdata
command, and the bytes package.

go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler,
the linker, the trace command, the covdata command, and the bytes, go/types, and
os/exec packages.

Log message:
go: update to 1.22.5 and 1.21.12 (security)

These minor releases include 1 security fix following the security policy:

net/http: denial of service due to improper 100-continue handling

The net/http HTTP/1.1 client mishandled the case where a server responds to a
request with an "Expect: 100-continue" header with a non-informational \ 
(200 or
higher) status. This mishandling could leave a client connection in an invalid
state, where the next request sent on the connection will fail.

An attacker sending a request to a net/http/httputil.ReverseProxy proxy can
exploit this mishandling to cause a denial of service by sending "Expect:
100-continue" requests which elicit a non-informational response from the
backend. Each such request leaves the proxy with an invalid connection, and
causes one subsequent request using that connection to fail.

Thanks to Geoff Franks for reporting this issue.

This is CVE-2024-24791 and Go issue https://go.dev/issue/67555.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.22.5

Log message:
go121: update to 1.21.11 (security)

This minor release includes 2 security fixes following the security policy:

- archive/zip: mishandling of corrupt central directory record

  The archive/zip package's handling of certain types of invalid zip files
  differed from the behavior of most zip implementations. This misalignment
  could be exploited to create an zip file with contents that vary depending on
  the implementation reading the file. The archive/zip package now rejects
  files containing these errors.

  Thanks to Yufan You (@ouuan) for reporting this issue.

  This is CVE-2024-24789 and Go issue https://go.dev/issue/66869.

- net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected
  for IPv4-mapped IPv6 addresses, returning false for addresses which would
  return true in their traditional IPv4 forms.

  Thanks to Enze Wang of Alioth (@zer0yu) and Jianjun Chen of Zhongguancun Lab
  (@chenjj) for reporting this issue.

  This is CVE-2024-24790 and Go issue https://go.dev/issue/67680.

Log message:
go121: Support O_DIRECT on illumos.

Log message:
go121: Update to 1.21.9.

This minor release includes 1 security fix following the security policy:

http2: close connections when receiving too many headers

Maintaining HPACK state requires that we parse and process all HEADERS and
CONTINUATION frames on a connection. When a request's headers exceed
MaxHeaderBytes, we don't allocate memory to store the excess headers but we do
parse them. This permits an attacker to cause an HTTP/2 endpoint to read
arbitrary amounts of header data, all associated with a request which is going
to be rejected. These headers can include Huffman-encoded data which is
significantly more expensive for the receiver to decode than for an attacker to
send.

Set a limit on the amount of excess header frames we will process before
closing a connection.

Thanks to Bartek Nowotarski (https://nowotarski.info/) for reporting this
issue.

This is CVE-2023-45288 and Go issue https://go.dev/issue/65051.

Log message:
go121: Implement syscall.Mkfifo() on illumos.

Log message:
go121: update to 1.21.8 (security)

This minor release includes 5 security fixes following the security policy:

- crypto/x509: Verify panics on certificates with an unknown public key
  algorithm

  Verifying a certificate chain which contains a certificate with an unknown
  public key algorithm will cause Certificate.Verify to panic.

  This affects all crypto/tls clients, and servers that set Config.ClientAuth
  to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default
  behavior is for TLS servers to not verify client certificates.

  Thanks to John Howard (Google) for reporting this issue.

  This is CVE-2024-24783 and Go issue https://go.dev/issue/65390.

- net/http: memory exhaustion in Request.ParseMultipartForm

  When parsing a multipart form (either explicitly with
  Request.ParseMultipartForm or implicitly with Request.FormValue,
  Request.PostFormValue, or Request.FormFile), limits on the total size of the
  parsed form were not applied to the memory consumed while reading a single
  form line. This permitted a maliciously crafted input containing very long
  lines to cause allocation of arbitrarily large amounts of memory, potentially
  leading to memory exhaustion.

  ParseMultipartForm now correctly limits the maximum size of form lines.

  Thanks to Bartek Nowotarski for reporting this issue.

  This is CVE-2023-45290 and Go issue https://go.dev/issue/65383.

- net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and
  cookies on HTTP redirect

  When following an HTTP redirect to a domain which is not a subdomain match or
  exact match of the initial domain, an http.Client does not forward sensitive
  headers such as "Authorization" or "Cookie". For example, \ 
a redirect from
  foo.com to www.foo.com will forward the Authorization header, but a redirect
  to bar.com will not.

  A maliciously crafted HTTP redirect could cause sensitive headers to be
  unexpectedly forwarded.

  Thanks to Juho Nurminen of Mattermost for reporting this issue.

  This is CVE-2023-45289 and Go issue https://go.dev/issue/65065.

- html/template: errors returned from MarshalJSON methods may break template
  escaping

  If errors returned from MarshalJSON methods contain user controlled data,
  they may be used to break the contextual auto-escaping behavior of the
  html/template package, allowing for subsequent actions to inject unexpected
  content into templates.

  Thanks to RyotaK (https://ryotak.net) for reporting this issue.

  This is CVE-2024-24785 and Go issue https://go.dev/issue/65697.

- net/mail: comments in display names are incorrectly handled

  The ParseAddressList function incorrectly handles comments (text within
  parentheses) within display names. Since this is a misalignment with
  conforming address parsers, it can result in different trust decisions being
  made by programs using different parsers.

  Thanks to Juho Nurminen of Mattermost and Slonser
  (https://github.com/Slonser) for reporting this issue.

  This is CVE-2024-24784 and Go issue https://go.dev/issue/65083.

Log message:
go121: update 1.21.7

go1.21.7 (released 2024-02-06) includes fixes to the compiler, the go command,
the runtime, and the crypto/x509 package. See the Go 1.21.7 milestone on the Go
issue tracker for details.