git.iko.soy/typeable/oauth2-proxy
on master help sign in
Fix vulnerabilities on crypto, net and sys packages and change go ver… (#1774)

* Fix vulnerabilities on crypto, net and sys packages and change go version on Docker builder stage * Changelog related PR $1774 Co-authored-by: Felipe Bonvicini Conti <felipe.conti@totvs.com.br>

commitff03c43842d66afb9bbbb9252850e3870b1b75a7 authorFelipe B. Conti <felipeconti18@gmail.com> dateWed 31 Aug 2022, 17:37 (4 years ago) parent884c4ee
4 files changed+12−7
compare with master
unifiedsplit
CHANGELOG.md+2 Dockerfile+1−1 go.mod+3−3 go.sum+6−3
CHANGELOG.md+2
@@ -15,6 +15,8 @@
1515
1616- [#1720](https://github.com/oauth2-proxy/oauth2-proxy/pull/1720) Extract roles from authToken, to allow using allowed roles with Keycloak.
1717
18+- [#1774](https://github.com/oauth2-proxy/oauth2-proxy/pull/1774) Fix vulnerabilities CVE-2022-27191, CVE-2021-44716 and CVE-2022-29526
19+
1820# V7.3.0
1921
2022## Release Highlights
Dockerfile+1−1
@@ -5,7 +5,7 @@ ARG RUNTIME_IMAGE=alpine:3.15
55# cache sharing of the go mod download step.
66# Go cross compilation is also faster than emulation the go compilation across
77# multiple platforms.
8−FROM --platform=${BUILDPLATFORM} golang:1.17-buster AS builder
8+FROM --platform=${BUILDPLATFORM} golang:1.18-buster AS builder
99
1010# Copy sources
1111WORKDIR $GOPATH/src/github.com/oauth2-proxy/oauth2-proxy
go.mod+3−3
@@ -29,8 +29,8 @@ require (
2929 github.com/spf13/viper v1.6.3
3030 github.com/stretchr/testify v1.7.0
3131 github.com/vmihailenco/msgpack/v4 v4.3.11
32− golang.org/x/crypto v0.0.0-20220214200702-86341886e292
33− golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2
32+ golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b
33+ golang.org/x/net v0.0.0-20211209124913-491a49abca63
3434 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
3535 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a
3636 google.golang.org/api v0.20.0
@@ -68,7 +68,7 @@ require (
6868 github.com/yuin/gopher-lua v0.0.0-20191220021717-ab39c6098bdb // indirect
6969 go.opencensus.io v0.22.2 // indirect
7070 go.opentelemetry.io/otel v0.11.0 // indirect
71− golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect
71+ golang.org/x/sys v0.0.0-20220412211240-33da011f77ad // indirect
7272 golang.org/x/text v0.3.7 // indirect
7373 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 // indirect
7474 google.golang.org/appengine v1.6.5 // indirect
go.sum+6−3
@@ -312,8 +312,9 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
312312golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
313313golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
314314golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
315−golang.org/x/crypto v0.0.0-20220214200702-86341886e292 h1:f+lwQ+GtmgoY+A2YaQxlSOnDjXcQ7ZRLWOHbC6HtRqE=
316315golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
316+golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b h1:Qwe1rC8PSniVfAFPFJeyUkB+zcysC3RgJBAGk7eqBEU=
317+golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
317318golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
318319golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
319320golang.org/x/exp v0.0.0-20200908183739-ae8ad444f925/go.mod h1:1phAWC201xIgDyaFpmDeZkgf70Q4Pd/CNqfRtVPtxNw=
@@ -350,8 +351,9 @@ golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/
350351golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
351352golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
352353golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
353−golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2 h1:CIJ76btIcR3eFI5EgSo6k1qKw9KJexJuRLI9G7Hp5wE=
354354golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
355+golang.org/x/net v0.0.0-20211209124913-491a49abca63 h1:iocB37TsdFuN6IBRZ+ry36wrkoV51/tl5vOWqkcPGvY=
356+golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
355357golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
356358golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
357359golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -391,8 +393,9 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
391393golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
392394golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
393395golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
394−golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
395396golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
397+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad h1:ntjMns5wyP/fN65tdBD4g8J5w8n015+iIIs9rtjXkY0=
398+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
396399golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
397400golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
398401golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=