From 1f9c16310ac12b0517ba98ba71de15b7d2423665 Mon Sep 17 00:00:00 2001 From: Robert Van Voorhees Date: Wed, 17 Jun 2020 07:57:05 -0400 Subject: [PATCH] [security] Vulnerability in golang.org/x/text/encoding/unicode v0.3.2 Hello gophers, Version v0.3.3 of golang.org/x/text fixes a vulnerability in the golang.org/x/text/encoding/unicode package which could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String. transform.String has also been hardened not to enter an infinite loop if a Transformer keeps returning ErrShortSrc even if atEOF is true. This issue was first filed as Issue 39491 by GitHub user abacabadabacaba and reported to the security team by Anton Gyllenberg. It is tracked as CVE-2020-14040. Cheers, Katie for the Go team Kubernetes-commit: 3cef97e8b5f67b4a350ee7a51e68604732e46f58 --- go.mod | 13 +++++++------ go.sum | 6 ++---- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index ea4a773..3df9cca 100644 --- a/go.mod +++ b/go.mod @@ -5,15 +5,16 @@ module k8s.io/kube-controller-manager go 1.13 require ( - k8s.io/apimachinery v0.0.0-20200617050244-c1bd2c2a276f - k8s.io/component-base v0.0.0-20200617051220-6c60a4d2ed11 + k8s.io/apimachinery v0.0.0 + k8s.io/component-base v0.0.0 ) replace ( golang.org/x/sys => golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a // pinned to release-branch.go1.13 golang.org/x/tools => golang.org/x/tools v0.0.0-20190821162956-65e3620a7ae7 // pinned to release-branch.go1.13 - k8s.io/api => k8s.io/api v0.0.0-20200617050422-8dc28b782f8e - k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20200617050244-c1bd2c2a276f - k8s.io/client-go => k8s.io/client-go v0.0.0-20200617050643-3c831c893e8a - k8s.io/component-base => k8s.io/component-base v0.0.0-20200617051220-6c60a4d2ed11 + k8s.io/api => ../api + k8s.io/apimachinery => ../apimachinery + k8s.io/client-go => ../client-go + k8s.io/component-base => ../component-base + k8s.io/kube-controller-manager => ../kube-controller-manager ) diff --git a/go.sum b/go.sum index d9318e2..7d4ed47 100644 --- a/go.sum +++ b/go.sum @@ -240,6 +240,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= +golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -300,10 +302,6 @@ honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWh honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= -k8s.io/api v0.0.0-20200617050422-8dc28b782f8e/go.mod h1:kD7EG+Wyq5Fu0MAEBkXyQVnnjyj/ChS5/vewKVRDaYI= -k8s.io/apimachinery v0.0.0-20200617050244-c1bd2c2a276f/go.mod h1:OO1oUmqmYEvK9/2GigG7tpElec1NAKGniAPppy1PJGA= -k8s.io/client-go v0.0.0-20200617050643-3c831c893e8a/go.mod h1:2QsvbX+hSBkSjVpimrdvrpStagCTqdSQxNnzGIxk1YY= -k8s.io/component-base v0.0.0-20200617051220-6c60a4d2ed11/go.mod h1:SIJ3hZh19C0QhquEIfpd0PWNnQPXJvrH9ClSZPF25sI= k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= k8s.io/klog/v2 v2.0.0 h1:Foj74zO6RbjjP4hBEKjnYtjjAhGg4jNynUdYF6fJrok= k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=