Skip to content

Commit

Permalink
Update golang version for telemetry build in sonic-slave-buster to fix (
Browse files Browse the repository at this point in the history
#14636)

Update golang version for telemetry build in sonic-slave-jessie to fix CVE-2021-33195, this PR will be merged into 201911 branch finally.

#### Why I did it
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format. Now in 201911 and 202012 branch we're using 1.14.2

##### Work item tracking
- Microsoft ADO **(number only)**:17727291

#### How I did it
Bump golang version into 1.15.15 which contains corresponding fix.

#### How to verify it
unit test to do sanity check.
  • Loading branch information
FengPan-Frank authored Apr 17, 2023
1 parent 7931abd commit 46c0d07
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion sonic-slave-jessie/Dockerfile.j2
Original file line number Diff line number Diff line change
Expand Up @@ -261,7 +261,7 @@ RUN apt-get -y build-dep linux
{%- endif %}

# For gobgp and telemetry build
RUN export VERSION=1.14.2 \
RUN export VERSION=1.15.15 \
{%- if CONFIGURED_ARCH == "armhf" %}
&& wget https://storage.googleapis.com/golang/go$VERSION.linux-armv6l.tar.gz \
&& tar -C /usr/local -xzf go$VERSION.linux-armv6l.tar.gz \
Expand Down

0 comments on commit 46c0d07

Please sign in to comment.