Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 928539 (CVE-2023-45288)

Summary: <dev-lang/go-{1.21.9,1.22.2}: HTTP/2 CONTINUATION frames can be utilized for DoS attacks
Product: Gentoo Security Reporter: Christopher Fore <csfore>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: normal CC: williamh
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M
Whiteboard: A3 [glsa?]
Package list:
Runtime testing required: ---
Bug Depends on: 929011    
Bug Blocks: 928538    

Description Christopher Fore 2024-04-03 22:15:07 UTC
CVE-2023-45288:

The Go packages net/http and net/http2 packages do not limit the number of CONTINUATION frames read for an HTTP/2 request, which permits an attacker to provide an arbitrarily large set of headers for a single request, that will be read, decoded, and subsequently discarded, which may result in excessive CPU consumption.
Comment 1 Larry the Git Cow gentoo-dev 2024-04-09 04:39:52 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=316aa9d21519814ff91b9fe09ec7880577c96297

commit 316aa9d21519814ff91b9fe09ec7880577c96297
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2024-04-09 04:36:53 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2024-04-09 04:37:48 +0000

    dev-lang/go: add 1.21.9, 1.22.2
    
    Bug: https://bugs.gentoo.org/928539
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 dev-lang/go/Manifest         |   2 +
 dev-lang/go/go-1.21.9.ebuild | 210 ++++++++++++++++++++++++++++++++++++++++++
 dev-lang/go/go-1.22.2.ebuild | 213 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 425 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2024-05-04 04:22:24 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4e7326fd47126e8da1124bf4a02de017323ba7e3

commit 4e7326fd47126e8da1124bf4a02de017323ba7e3
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2024-05-04 04:21:10 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2024-05-04 04:21:10 +0000

    dev-lang/go: drop 1.21.5, 1.21.6, 1.21.7, 1.21.8, 1.22.1
    
    Bug: https://bugs.gentoo.org/928539
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 dev-lang/go/Manifest         |   5 -
 dev-lang/go/go-1.21.5.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.21.6.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.21.7.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.21.8.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.22.1.ebuild | 213 -------------------------------------------
 6 files changed, 1058 deletions(-)