CVE-2023-45288: The Go packages net/http and net/http2 packages do not limit the number of CONTINUATION frames read for an HTTP/2 request, which permits an attacker to provide an arbitrarily large set of headers for a single request, that will be read, decoded, and subsequently discarded, which may result in excessive CPU consumption.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=316aa9d21519814ff91b9fe09ec7880577c96297 commit 316aa9d21519814ff91b9fe09ec7880577c96297 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2024-04-09 04:36:53 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2024-04-09 04:37:48 +0000 dev-lang/go: add 1.21.9, 1.22.2 Bug: https://bugs.gentoo.org/928539 Signed-off-by: William Hubbs <williamh@gentoo.org> dev-lang/go/Manifest | 2 + dev-lang/go/go-1.21.9.ebuild | 210 ++++++++++++++++++++++++++++++++++++++++++ dev-lang/go/go-1.22.2.ebuild | 213 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 425 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4e7326fd47126e8da1124bf4a02de017323ba7e3 commit 4e7326fd47126e8da1124bf4a02de017323ba7e3 Author: William Hubbs <williamh@gentoo.org> AuthorDate: 2024-05-04 04:21:10 +0000 Commit: William Hubbs <williamh@gentoo.org> CommitDate: 2024-05-04 04:21:10 +0000 dev-lang/go: drop 1.21.5, 1.21.6, 1.21.7, 1.21.8, 1.22.1 Bug: https://bugs.gentoo.org/928539 Signed-off-by: William Hubbs <williamh@gentoo.org> dev-lang/go/Manifest | 5 - dev-lang/go/go-1.21.5.ebuild | 210 ------------------------------------------ dev-lang/go/go-1.21.6.ebuild | 210 ------------------------------------------ dev-lang/go/go-1.21.7.ebuild | 210 ------------------------------------------ dev-lang/go/go-1.21.8.ebuild | 210 ------------------------------------------ dev-lang/go/go-1.22.1.ebuild | 213 ------------------------------------------- 6 files changed, 1058 deletions(-)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=ec7d3c7515acf6f1890cb4bd01cca086f31ced54 commit ec7d3c7515acf6f1890cb4bd01cca086f31ced54 Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-08-07 09:30:14 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2024-08-07 09:30:29 +0000 [ GLSA 202408-07 ] Go: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/906043 Bug: https://bugs.gentoo.org/919310 Bug: https://bugs.gentoo.org/926530 Bug: https://bugs.gentoo.org/928539 Bug: https://bugs.gentoo.org/931602 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202408-07.xml | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+)