CVE-2022-41717

Excessive memory growth in net/http and golang.org/x/net/http2

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.18.9"},{"introduced":"1.19.0"},{"fixed":"1.19.4"}]}]

Go golang.org/x/net/http2

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]

Go golang.org/x/net

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2022-41717 golang-1.15
Ubuntu UBUNTU-CVE-2022-41717 golang-1.10

Références

Métadonnées

CVE: CVE-2022-41717
GHSA: GHSA-xrjj-mj9h-534m
Publication: 2022-12-08
Première détection SecPulse: il y a 2 ans
Source initiale: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-770

Sources de détection

OSV.dev (Open Source Vulnerabilities) il y a 2 mois