Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 928539 (CVE-2023-45288) - <dev-lang/go-{1.21.9,1.22.2}: HTTP/2 CONTINUATION frames can be utilized for DoS attacks
Summary: <dev-lang/go-{1.21.9,1.22.2}: HTTP/2 CONTINUATION frames can be utilized for ...
Status: CONFIRMED
Alias: CVE-2023-45288
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://groups.google.com/g/golang-an...
Whiteboard: A3 [glsa?]
Keywords:
Depends on: 929011
Blocks: VU#421644
  Show dependency tree
 
Reported: 2024-04-03 22:15 UTC by Christopher Fore
Modified: 2024-05-04 06:07 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Fore 2024-04-03 22:15:07 UTC 
CVE-2023-45288:

The Go packages net/http and net/http2 packages do not limit the number of CONTINUATION frames read for an HTTP/2 request, which permits an attacker to provide an arbitrarily large set of headers for a single request, that will be read, decoded, and subsequently discarded, which may result in excessive CPU consumption.
Comment 1 Larry the Git Cow gentoo-dev 2024-04-09 04:39:52 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=316aa9d21519814ff91b9fe09ec7880577c96297

commit 316aa9d21519814ff91b9fe09ec7880577c96297
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2024-04-09 04:36:53 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2024-04-09 04:37:48 +0000

    dev-lang/go: add 1.21.9, 1.22.2
    
    Bug: https://bugs.gentoo.org/928539
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 dev-lang/go/Manifest         |   2 +
 dev-lang/go/go-1.21.9.ebuild | 210 ++++++++++++++++++++++++++++++++++++++++++
 dev-lang/go/go-1.22.2.ebuild | 213 +++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 425 insertions(+)
Comment 2 Larry the Git Cow gentoo-dev 2024-05-04 04:22:24 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4e7326fd47126e8da1124bf4a02de017323ba7e3

commit 4e7326fd47126e8da1124bf4a02de017323ba7e3
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2024-05-04 04:21:10 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2024-05-04 04:21:10 +0000

    dev-lang/go: drop 1.21.5, 1.21.6, 1.21.7, 1.21.8, 1.22.1
    
    Bug: https://bugs.gentoo.org/928539
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 dev-lang/go/Manifest         |   5 -
 dev-lang/go/go-1.21.5.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.21.6.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.21.7.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.21.8.ebuild | 210 ------------------------------------------
 dev-lang/go/go-1.22.1.ebuild | 213 -------------------------------------------
 6 files changed, 1058 deletions(-)