CVE-2022-41717

Excessive memory growth in net/http and golang.org/x/net/http2

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.9"},{"introduced":"1.19.0"},{"fixed":"1.19.4"}]}]

Go golang.org/x/net/http2

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]

Go golang.org/x/net

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2022-41717 golang-1.15
Ubuntu UBUNTU-CVE-2022-41717 golang-1.10

参照URL

メタデータ

CVE: CVE-2022-41717
GHSA: GHSA-xrjj-mj9h-534m
公開日: 2022-12-08
SecPulse初出: 2年前
初出ソース: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-770

検知ソース

OSV.dev (Open Source Vulnerabilities) 2ヶ月前