Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security: fix CVE-2022-41722 [1.20 backport] #57276

Closed
gopherbot opened this issue Dec 13, 2022 · 3 comments
Closed

security: fix CVE-2022-41722 [1.20 backport] #57276

gopherbot opened this issue Dec 13, 2022 · 3 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Milestone
Go1.20.1

Comments

@gopherbot
Copy link

gopherbot commented Dec 13, 2022 •
edited by rolandshoemaker

@neild requested issue #57274 to be considered for backport to the next 1.20 minor release.

@gopherbot please open backport issues. This is a security fix.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Dec 13, 2022
@gopherbot gopherbot mentioned this issue Dec 13, 2022
Closed
@gopherbot gopherbot added this to the Go1.19.5 milestone Dec 13, 2022
@heschi heschi added the Security label Jan 4, 2023
@gopherbot gopherbot modified the milestones: Go1.19.5, Go1.19.6 Jan 10, 2023
@rolandshoemaker rolandshoemaker modified the milestones: Go1.19.6, Go1.20.1 Feb 6, 2023
@rolandshoemaker rolandshoemaker changed the title security: fix CVE-2022-41722 [1.19 backport] security: fix CVE-2022-41722 [1.20 backport] Feb 6, 2023
@rolandshoemaker
Copy link
Member

Manually bumping because backports were opened before 1.20 was released.

@dr2chase dr2chase added the CherryPickApproved Used during the release process for point releases label Feb 8, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Feb 8, 2023
@gopherbot
Copy link
Author

Change https://go.dev/cl/468119 mentions this issue: [release-branch.go1.20] path/filepath: do not Clean("a/../c:/b") into c:\b on Windows

@gopherbot
Copy link
Author

Closed by merging bdf07c2 to release-branch.go1.20.

gopherbot pushed a commit that referenced this issue Feb 14, 2023
@neild @gopherbot
[release-branch.go1.20] path/filepath: do not Clean("a/../c:/b") into…
bdf07c2 
… c:\b on Windows

Do not permit Clean to convert a relative path into one starting
with a drive reference. This change causes Clean to insert a .
path element at the start of a path when the original path does not
start with a volume name, and the first path element would contain
a colon.

This may introduce a spurious but harmless . path element under
some circumstances. For example, Clean("a/../b:/../c") becomes `.\c`.

This reverts CL 401595, since the change here supersedes the one
in that CL.

Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

Updates #57274
Fixes #57276
Fixes CVE-2022-41722

Change-Id: I837446285a03aa74c79d7642720e01f354c2ca17
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1675249
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
(cherry picked from commit 8ca37f4813ef2f64600c92b83f17c9f3ca6c03a5)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728944
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/468119
Reviewed-by: Than McIntosh <thanm@google.com>
Run-TryBot: Michael Pratt <mpratt@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Michael Pratt <mpratt@google.com>
romaindoumenc pushed a commit to TroutSoftware/go that referenced this issue Mar 3, 2023
@neild @romaindoumenc
[release-branch.go1.20] path/filepath: do not Clean("a/../c:/b") into…
e09e9a4 
… c:\b on Windows

Do not permit Clean to convert a relative path into one starting
with a drive reference. This change causes Clean to insert a .
path element at the start of a path when the original path does not
start with a volume name, and the first path element would contain
a colon.

This may introduce a spurious but harmless . path element under
some circumstances. For example, Clean("a/../b:/../c") becomes `.\c`.

This reverts CL 401595, since the change here supersedes the one
in that CL.

Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.

Updates golang#57274
Fixes golang#57276
Fixes CVE-2022-41722

Change-Id: I837446285a03aa74c79d7642720e01f354c2ca17
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1675249
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
(cherry picked from commit 8ca37f4813ef2f64600c92b83f17c9f3ca6c03a5)
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1728944
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/468119
Reviewed-by: Than McIntosh <thanm@google.com>
Run-TryBot: Michael Pratt <mpratt@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Michael Pratt <mpratt@google.com>
@golang golang locked and limited conversation to collaborators Feb 14, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Projects
None yet
Milestone
Go1.20.1
Development

No branches or pull requests
4 participants
@dr2chase @rolandshoemaker @gopherbot @heschi