diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b8f5d97..07f33683 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,13 @@ and this project adheres to ### Security +- Go version was updated to prevent the possibility of exploiting the + CVE-2022-1705, CVE-2022-32148, CVE-2022-30631, and other Go vulnerabilities + fixed in [Go 1.17.12][go-1.17.12]. + + - Weaker cipher suites that use the CBC (cipher block chaining) mode of operation have been disabled ([#2993]). @@ -49,7 +56,8 @@ and this project adheres to [#4698]: https://github.com/AdguardTeam/AdGuardHome/issues/4698 [#4699]: https://github.com/AdguardTeam/AdGuardHome/issues/4699 -[ddr-draft]: https://datatracker.ietf.org/doc/html/draft-ietf-add-ddr-08 +[ddr-draft]: https://datatracker.ietf.org/doc/html/draft-ietf-add-ddr-08 +[go-1.17.12]: https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE @@ -67,7 +75,7 @@ See also the [v0.107.7 GitHub milestone][ms-v0.107.7]. - Go version was updated to prevent the possibility of exploiting the [CVE-2022-29526], [CVE-2022-30634], [CVE-2022-30629], [CVE-2022-30580], and - [CVE-2022-29804] vulnerabilities. + [CVE-2022-29804] Go vulnerabilities. - Enforced password strength policy ([#3503]). ### Added @@ -222,7 +230,7 @@ See also the [v0.107.6 GitHub milestone][ms-v0.107.6]. - `User-Agent` HTTP header removed from outgoing DNS-over-HTTPS requests. - Go version was updated to prevent the possibility of exploiting the - [CVE-2022-24675], [CVE-2022-27536], and [CVE-2022-28327] vulnerabilities. + [CVE-2022-24675], [CVE-2022-27536], and [CVE-2022-28327] Go vulnerabilities. ### Added @@ -277,7 +285,7 @@ were resolved. ### Security - Go version was updated to prevent the possibility of exploiting the - [CVE-2022-24921] vulnerability. + [CVE-2022-24921] Go vulnerability. [CVE-2022-24921]: https://www.cvedetails.com/cve/CVE-2022-24921 @@ -290,7 +298,7 @@ See also the [v0.107.4 GitHub milestone][ms-v0.107.4]. ### Security - Go version was updated to prevent the possibility of exploiting the - [CVE-2022-23806], [CVE-2022-23772], and [CVE-2022-23773] vulnerabilities. + [CVE-2022-23806], [CVE-2022-23772], and [CVE-2022-23773] Go vulnerabilities. ### Fixed diff --git a/bamboo-specs/release.yaml b/bamboo-specs/release.yaml index 694430ac..581ce55a 100644 --- a/bamboo-specs/release.yaml +++ b/bamboo-specs/release.yaml @@ -7,7 +7,7 @@ # Make sure to sync any changes with the branch overrides below. 'variables': 'channel': 'edge' - 'dockerGo': 'adguard/golang-ubuntu:4.4' + 'dockerGo': 'adguard/golang-ubuntu:4.5' 'stages': - 'Make release': @@ -285,7 +285,7 @@ # need to build a few of these. 'variables': 'channel': 'beta' - 'dockerGo': 'adguard/golang-ubuntu:4.4' + 'dockerGo': 'adguard/golang-ubuntu:4.5' # release-vX.Y.Z branches are the branches from which the actual final release # is built. - '^release-v[0-9]+\.[0-9]+\.[0-9]+': @@ -300,4 +300,4 @@ # are the ones that actually get released. 'variables': 'channel': 'release' - 'dockerGo': 'adguard/golang-ubuntu:4.4' + 'dockerGo': 'adguard/golang-ubuntu:4.5' diff --git a/bamboo-specs/test.yaml b/bamboo-specs/test.yaml index cf11aa2e..30818cd4 100644 --- a/bamboo-specs/test.yaml +++ b/bamboo-specs/test.yaml @@ -5,7 +5,7 @@ 'key': 'AHBRTSPECS' 'name': 'AdGuard Home - Build and run tests' 'variables': - 'dockerGo': 'adguard/golang-ubuntu:4.4' + 'dockerGo': 'adguard/golang-ubuntu:4.5' 'stages': - 'Tests':