Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

security: fix CVE-2022-41722 [1.19 backport] #57275

Closed
gopherbot opened this issue Dec 13, 2022 · 3 comments
Closed

security: fix CVE-2022-41722 [1.19 backport] #57275

gopherbot opened this issue Dec 13, 2022 · 3 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Milestone

Comments

@gopherbot
Copy link

gopherbot commented Dec 13, 2022

@neild requested issue #57274 to be considered for backport to the next 1.19 minor release.

@gopherbot please open backport issues. This is a security fix.

@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Dec 13, 2022
@gopherbot gopherbot added this to the Go1.18.10 milestone Dec 13, 2022
@heschi heschi added the Security label Jan 4, 2023
@gopherbot gopherbot modified the milestones: Go1.18.10, Go1.18.11 Jan 10, 2023
@rolandshoemaker rolandshoemaker modified the milestones: Go1.18.11, Go1.19.6 Feb 6, 2023
@rolandshoemaker rolandshoemaker changed the title security: fix CVE-2022-41722 [1.18 backport] security: fix CVE-2022-41722 [1.19 backport] Feb 6, 2023
@rolandshoemaker
Copy link
Member

Manually bumping because backports were opened before 1.20 was released.

@dr2chase dr2chase added the CherryPickApproved Used during the release process for point releases label Feb 8, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Feb 8, 2023
@gopherbot
Copy link
Author

Change https://go.dev/cl/468115 mentions this issue: [release-branch.go1.19] path/filepath: do not Clean("a/../c:/b") into c:\b on Windows

gopherbot pushed a commit that referenced this issue Feb 14, 2023
… c:\b on Windows

Do not permit Clean to convert a relative path into one starting
with a drive reference. This change causes Clean to insert a .
path element at the start of a path when the original path does not
start with a volume name, and the first path element would contain
a colon.

This may introduce a spurious but harmless . path element under
some circumstances. For example, Clean("a/../b:/../c") becomes `.\c`.

This reverts CL 401595, since the change here supersedes the one
in that CL.

Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

Updates #57274
Fixes #57275
Fixes CVE-2022-41722

Change-Id: I837446285a03aa74c79d7642720e01f354c2ca17
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1675249
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
(cherry picked from commit 780dfa043ff5192c37de0d6fd1053a66b2b9f378)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728206
Reviewed-by: Damien Neil <dneil@google.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/468115
Reviewed-by: Than McIntosh <thanm@google.com>
Run-TryBot: Michael Pratt <mpratt@google.com>
Auto-Submit: Michael Pratt <mpratt@google.com>
TryBot-Bypass: Michael Pratt <mpratt@google.com>
@gopherbot
Copy link
Author

Closed by merging 3345ddc to release-branch.go1.19.

@golang golang locked and limited conversation to collaborators Feb 14, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Projects
None yet
Development

No branches or pull requests

4 participants