packer

Commit Graph

Author	SHA1	Message	Date
Wilken Rivera	f1efdee2dd	Bump Go version to 1.12.10 to address CVE-2024-24787 Packer does not rely on CGO and is not susceptible to CVE-2024-24787 vulnerabilities, but we are upgrading as a safeguard.	2 years ago
Wilken Rivera	e3c8d9b929	Bump Go toolchain to 1.21.8 This change addresses vulnerabilities reported by govulncheck ``` Vulnerability #1: GO-2024-2610 Errors returned from JSON marshaling may break template escaping in html/template More info: https://pkg.go.dev/vuln/GO-2024-2610 Standard library Found in: html/template@go1.22 Fixed in: html/template@go1.22.1 Example traces found: #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.Execute #2: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do, which eventually calls template.Template.ExecuteTemplate Vulnerability #2: GO-2024-2600 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http More info: https://pkg.go.dev/vuln/GO-2024-2600 Standard library Found in: net/http@go1.22 Fixed in: net/http@go1.22.1 Example traces found: #1: datasource/http/data.go:119:24: http.Datasource.Execute calls http.Client.Do #2: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.Post #3: hcl2template/function/aws_secretetkey.go:38:37: function.init calls template.GetAWSSecret, which eventually calls http.Client.PostForm Vulnerability #3: GO-2024-2599 Memory exhaustion in multipart form parsing in net/textproto and net/http More info: https://pkg.go.dev/vuln/GO-2024-2599 Standard library Found in: net/textproto@go1.22 Fixed in: net/textproto@go1.22.1 Example traces found: #1: internal/hcp/api/service_build.go:81:48: api.Client.UpdateBuild calls packer_service.Client.PackerServiceUpdateBuild, which eventually calls textproto.Reader.ReadLine #2: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader Vulnerability #4: GO-2024-2598 Verify panics on certificates with an unknown public key algorithm in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2024-2598 Standard library Found in: crypto/x509@go1.22 Fixed in: crypto/x509@go1.22.1 Example traces found: #1: datasource/http/data.go:140:26: http.Datasource.Execute calls io.ReadAll, which eventually calls x509.Certificate.Verify ```	2 years ago
Wilken Rivera	0a64a5fb90	Bump Go version to 1.20.12 Bumped to pull in security fixes to the go command, the net/http package, and path/filepath package.	2 years ago
Wilken Rivera	4b1553c7da	Bump Go to 1.20.11 to mitigate against insecure Windows path parsing This change address CVE-2023-45283. There have been no reported issues with Packer but we are bumping given its usage of the path/filepath pkg.	3 years ago
Jamie Finnigan	0e5776a9af	build with Go 1.20.10	3 years ago
Wilken Rivera	8dcc6b9fd9	Bump Go tooling version to 1.20.8	3 years ago
Jamie Finnigan	a0cb19927c	.go-version: bump version of Go to 1.20.7	3 years ago
Wilken Rivera	353882b00c	.go-version: Bump version of Go to 1.20.4	3 years ago
Wilken Rivera	ddd7ee98b6	Bump go.mod to 1.20 * Fix go vet issue * Bump Go tooling to version 1.20 * Update workflows to use go-version file	3 years ago
Lucas Bajolet	0aa2df1027	go-version: bump to 1.18.9 The go 1.18.9 version fixes a vulnerability GO-2022-1144, which concerns the net/http and golang.org/x/net packages. These are used in the codebase, and therefore automated tools report the generated binaries as vulnerable to this. Note that while Packer is indeed vulnerable to this, this is a DoS attack. This is therefore unlikely to impact Packer severely, especially as it requires a deliberate attempt to provoke an OOM/excessive GC cycles. Nonetheless, since this vulnerability is fixed with go 1.18.9, we bump the version used to build/test the tools to this version.	3 years ago
Wilken Rivera	d7dca51108	Update Packer to use Go 1.18 (#11927 ) This change updates Packer core Go version to 1.18. The move to Go 1.18 and not Go 1.19 is to allow the HCP Packer SDK time to upgrade to Go 1.18. Changes Made: * Bump go mod file to use Go 1.18 * Bump release pipeline to use Go 1.18 * Update plugin updater script to run go mod tidy for Go 1.18 * Update Linux job to use setup-go action	4 years ago
Wilken Rivera	172724e466	Bump to go1.17.11	4 years ago
Wilken Rivera	2ea4c38c35	Bump Go version	4 years ago
Michele Degges	b63a9c9803	Onboard to CRT (#11564 ) Onboard Packer to CRT Co-authored-by: Wilken Rivera <wilken@hashicorp.com> Co-authored-by: Claire Labry <claire@hashicorp.com>	4 years ago

14 Commits (plugin_load_spec_docs)