Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) [1.19 backport] #59269

Closed
gopherbot opened this issue Mar 27, 2023 · 10 comments
Closed

net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) [1.19 backport] #59269

gopherbot opened this issue Mar 27, 2023 · 10 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Milestone
Go1.19.8

Comments

@gopherbot
Copy link
Contributor

@julieqiu requested issue #59153 to be considered for backport to the next 1.19 minor release.

@gopherbot please open backport issues.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Mar 27, 2023
@gopherbot gopherbot mentioned this issue Mar 27, 2023
Closed
@gopherbot gopherbot added this to the Go1.19.8 milestone Mar 27, 2023
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/481979 mentions this issue: [release-branch.go1.19] mime/multipart: limit parsed mime message sizes

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/481977 mentions this issue: [release-branch.go1.19] mime/multipart: avoid excessive copy buffer allocations in ReadForm

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/481978 mentions this issue: [release-branch.go1.19] net/textproto, mime/multipart: improve accounting of non-file data

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/481985 mentions this issue: [release-branch.go1.19] mime/multipart: limit parsed mime message sizes

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/481983 mentions this issue: [release-branch.go1.19] mime/multipart: avoid excessive copy buffer allocations in ReadForm

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/481984 mentions this issue: [release-branch.go1.19] net/textproto, mime/multipart: improve accounting of non-file data

@gopherbot
Copy link
Contributor Author

Closed by merging 7a359a6 to release-branch.go1.19.

@gopherbot
Copy link
Contributor Author

Closed by merging 7917b5f to release-branch.go1.19.

@gopherbot
Copy link
Contributor Author

Closed by merging ef41a4e to release-branch.go1.19.

gopherbot pushed a commit that referenced this issue Apr 4, 2023
@neild @gopherbot
[release-branch.go1.19] mime/multipart: avoid excessive copy buffer a…
ef41a4e 
…llocations in ReadForm

When copying form data to disk with io.Copy,
allocate only one copy buffer and reuse it rather than
creating two buffers per file (one from io.multiReader.WriteTo,
and a second one from os.File.ReadFrom).

Thanks to Jakob Ackermann (@das7pad) for reporting this issue.

For CVE-2023-24536
For #59153
For #59269

Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802453
Run-TryBot: Damien Neil <[email protected]>
Reviewed-by: Julie Qiu <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802395
Run-TryBot: Roland Shoemaker <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Change-Id: Ie405470c92abffed3356913b37d813e982c96c8b
Reviewed-on: https://go-review.googlesource.com/c/go/+/481983
Run-TryBot: Michael Knyszek <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
Reviewed-by: Matthew Dempsky <[email protected]>
gopherbot pushed a commit that referenced this issue Apr 4, 2023
@neild @gopherbot
[release-branch.go1.19] net/textproto, mime/multipart: improve accoun…
7a359a6 
…ting of non-file data

For requests containing large numbers of small parts,
memory consumption of a parsed form could be about 250%
over the estimated size.

When considering the size of parsed forms, account for the size of
FileHeader structs and increase the estimate of memory consumed by
map entries.

Thanks to Jakob Ackermann (@das7pad) for reporting this issue.

For CVE-2023-24536
For #59153
For #59269

Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802454
Run-TryBot: Damien Neil <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-by: Julie Qiu <[email protected]>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802396
Run-TryBot: Roland Shoemaker <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Change-Id: I31bc50e9346b4eee6fbe51a18c3c57230cc066db
Reviewed-on: https://go-review.googlesource.com/c/go/+/481984
Reviewed-by: Matthew Dempsky <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Michael Knyszek <[email protected]>
gopherbot pushed a commit that referenced this issue Apr 4, 2023
@neild @gopherbot
[release-branch.go1.19] mime/multipart: limit parsed mime message sizes
7917b5f 
The parsed forms of MIME headers and multipart forms can consume
substantially more memory than the size of the input data.
A malicious input containing a very large number of headers or
form parts can cause excessively large memory allocations.

Set limits on the size of MIME data:

Reader.NextPart and Reader.NextRawPart limit the the number
of headers in a part to 10000.

Reader.ReadForm limits the total number of headers in all
FileHeaders to 10000.

Both of these limits may be set with with
GODEBUG=multipartmaxheaders=<values>.

Reader.ReadForm limits the number of parts in a form to 1000.
This limit may be set with GODEBUG=multipartmaxparts=<value>.

Thanks for Jakob Ackermann (@das7pad) for reporting this issue.

For CVE-2023-24536
For #59153
For #59269

Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1802455
Run-TryBot: Damien Neil <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-by: Julie Qiu <[email protected]>
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1801087
Reviewed-by: Damien Neil <[email protected]>
Run-TryBot: Roland Shoemaker <[email protected]>
Change-Id: If134890d75f0d95c681d67234daf191ba08e6424
Reviewed-on: https://go-review.googlesource.com/c/go/+/481985
Run-TryBot: Michael Knyszek <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Matthew Dempsky <[email protected]>
@mknyszek mknyszek changed the title security: fix CVE-2023-24536 [1.19 backport] net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) [1.19 backport] Apr 4, 2023
@mknyszek mknyszek added the CherryPickApproved Used during the release process for point releases label Apr 4, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Apr 4, 2023
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/482535 mentions this issue: [release-branch.go1.19] html/template,mime/multipart: document new GODEBUG settings

gopherbot pushed a commit that referenced this issue Apr 5, 2023
@mknyszek @gopherbot
[release-branch.go1.19] html/template,mime/multipart: document new GO…
22c1d18 
…DEBUG settings

This change documents the new GODEBUG settings introduced for
html/template and mime/multipart, released with Go 1.19.8 and Go 1.20.3
as part of a security fix.

Updates #59153.
For #59269.
Updates #59234.
For #59271.

Change-Id: I25f4d8245da3301dccccfb44da8ff1a5985392a4
Reviewed-on: https://go-review.googlesource.com/c/go/+/482535
TryBot-Result: Gopher Robot <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Run-TryBot: Michael Knyszek <[email protected]>
@golang golang locked and limited conversation to collaborators Apr 4, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge Security
Projects
None yet
Milestone
Go1.19.8
Development

No branches or pull requests
3 participants
@mknyszek @dmitshur @gopherbot