go_1_21: 1.21.7 -> 1.21.8

[katexochen]

Description of changes

These minor releases include 5 security fixes following the security policy:

crypto/x509: Verify panics on certificates with an unknown public key algorithm

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.

This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

Thanks to John Howard (Google) for reporting this issue.

This is CVE-2024-24783 and Go issue https://go.dev/issue/65390.

net/http: memory exhaustion in Request.ParseMultipartForm

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permitted a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion.

ParseMultipartForm now correctly limits the maximum size of form lines.

Thanks to Bartek Nowotarski for reporting this issue.

This is CVE-2023-45290 and Go issue https://go.dev/issue/65383.

net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not.

A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

Thanks to Juho Nurminen of Mattermost for reporting this issue.

This is CVE-2023-45289 and Go issue https://go.dev/issue/65065.

html/template: errors returned from MarshalJSON methods may break template escaping

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

Thanks to RyotaK (https://ryotak.net/) for reporting this issue.

This is CVE-2024-24785 and Go issue https://go.dev/issue/65697.

net/mail: comments in display names are incorrectly handled

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

Thanks to Juho Nurminen of Mattermost and Slonser (https://github.com/Slonser) for reporting this issue.

This is CVE-2024-24784 and Go issue https://go.dev/issue/65083.

https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg/m/46oA5yPABQAJ?utm_medium=email&utm_source=footer

Things done

• Built on platform(s)
  • [x] x86_64-linux
  • [ ] aarch64-linux
  • [ ] x86_64-darwin
  • [ ] aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • [ ] sandbox = relaxed
  • [ ] sandbox = true
• [ ] Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• [ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• [x] Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • [ ] (Package updates) Added a release notes entry if the change is major or breaking
  • [ ] (Module updates) Added a release notes entry if the change is significant
  • [ ] (Module addition) Added a release notes entry if adding a new NixOS module
• [x] Fits CONTRIBUTING.md.

---

Add a :+1: reaction to pull requests you find important.

[katexochen]

Go 1.22 can go straight to master

True, I've cherry picked the 1.22 update into https://github.com/NixOS/nixpkgs/pull/293580.

[kirillrdy]

same as for https://github.com/NixOS/nixpkgs/pull/293580, can we add release notes to commit message

[kirillrdy]

cc @mweinelt

[github-actions[bot]]

Backport failed for staging-23.11, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin staging-23.11
git worktree add -d .worktree/backport-293563-to-staging-23.11 origin/staging-23.11
cd .worktree/backport-293563-to-staging-23.11
git switch --create backport-293563-to-staging-23.11
git cherry-pick -x 5b02c75ac07a1ad525f1d7bfc305a4359d0f2917