go, branch go1.12.11

[release-branch.go1.12-security] go1.12.11

2019-10-17T17:32:27Z

Change-Id: I8421754104cb795270dbcb6f554ed3a78a719483 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/575988 Reviewed-by: Filippo Valsorda

[release-branch.go1.12-security] doc: document Go 1.12.11

2019-10-17T15:57:19Z

Change-Id: I73f27924046a0a2493330ddc732d1a2fd3f730a5 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/575981 Reviewed-by: Filippo Valsorda Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/575985

[release-branch.go1.12-security] crypto/dsa: prevent bad public keys from causing panic

2019-10-16T21:24:47Z

dsa.Verify might currently use a nil s inverse in a multiplication if the public key contains a non-prime Q, causing a panic. Change this to check that the mod inverse exists before using it. Fixes CVE-2019-17596 Change-Id: I94d5f3cc38f1b5d52d38dcb1d253c71b7fd1cae7 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/572809 Reviewed-by: Filippo Valsorda (cherry picked from commit 9119dfb0511326d4485b248b83d4fde19c95d0f7) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/575232

[release-branch.go1.12-security] go1.12.10

2019-09-25T18:48:21Z

Change-Id: I64d76a35ad113110cb83117c6ce5d4d923d93c93 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558789 Reviewed-by: Dmitri Shuralyov

[release-branch.go1.12-security] doc: document Go 1.12.10

2019-09-25T17:22:36Z

Change-Id: If694ce529393b8ae9c6c55270665efc3a108a3b2 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558778 Reviewed-by: Dmitri Shuralyov Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558784

[release-branch.go1.12-security] net/textproto: don't normalize headers with spaces before the colon

2019-09-25T17:15:22Z

RFC 7230 is clear about headers with a space before the colon, like X-Answer : 42 being invalid, but we've been accepting and normalizing them for compatibility purposes since CL 5690059 in 2012. On the client side, this is harmless and indeed most browsers behave the same to this day. On the server side, this becomes a security issue when the behavior doesn't match that of a reverse proxy sitting in front of the server. For example, if a WAF accepts them without normalizing them, it might be possible to bypass its filters, because the Go server would interpret the header differently. Worse, if the reverse proxy coalesces requests onto a single HTTP/1.1 connection to a Go server, the understanding of the request boundaries can get out of sync between them, allowing an attacker to tack an arbitrary method and path onto a request by other clients, including authentication headers unknown to the attacker. This was recently presented at multiple security conferences: https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn net/http servers already reject header keys with invalid characters. Simply stop normalizing extra spaces in net/textproto, let it return them unchanged like it does for other invalid headers, and let net/http enforce RFC 7230, which is HTTP specific. This loses us normalization on the client side, but there's no right answer on the client side anyway, and hiding the issue sounds worse than letting the application decide. Fixes CVE-2019-16276 Change-Id: I6d272de827e0870da85d93df770d6a0e161bbcf1 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/549719 Reviewed-by: Brad Fitzpatrick (cherry picked from commit 1280b868e82bf173ea3e988be3092d160ee66082) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/558776 Reviewed-by: Dmitri Shuralyov

[release-branch.go1.12] go1.12.9

2019-08-15T18:44:01Z

Change-Id: I70dc0e2accd83d9c974b95075f9e83a82d89563d Reviewed-on: https://go-review.googlesource.com/c/go/+/190407 Run-TryBot: Dmitri Shuralyov TryBot-Result: Gobot Gobot Reviewed-by: Alexander Rakoczy

[release-branch.go1.12] doc: document Go 1.12.9

2019-08-15T17:54:39Z

Change-Id: I88b7e085fc70f9c021788d364099f5bc6b705ba8 Reviewed-on: https://go-review.googlesource.com/c/go/+/190438 Reviewed-by: Filippo Valsorda (cherry picked from commit 0212f0410f845815f5327a7f2e705891a9598f3d) Reviewed-on: https://go-review.googlesource.com/c/go/+/190406 Reviewed-by: Alexander Rakoczy

[release-branch.go1.12] all: merge release-branch.go1.12-security into release-branch.go1.12

2019-08-13T17:14:07Z

Change-Id: I29801b98d975da0bbc092b16dc9771564a39a10a

[release-branch.go1.12-security] go1.12.8

2019-08-13T16:27:09Z

Change-Id: I131f93770f9bc5f2d4ee73f158607c1c9e1550bb Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/527000 Reviewed-by: Filippo Valsorda