Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update module golang.org/x/net to v0.23.0 [security] (release-0.27) #4429

Merged

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 14, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
golang.org/x/net v0.21.0 -> v0.23.0 age adoption passing confidence

net/http, x/net/http2: close connections when receiving too many headers

BIT-golang-2023-45288 / CVE-2023-45288 / GHSA-4v7x-pqxf-cx7m / GO-2024-2687

More information

Details

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


HTTP/2 CONTINUATION flood in net/http

BIT-golang-2023-45288 / CVE-2023-45288 / GHSA-4v7x-pqxf-cx7m / GO-2024-2687

More information

Details

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.

This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.

The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot requested a review from a team as a code owner April 14, 2024 09:28
@renovate renovate bot added the security label Apr 14, 2024
@renovate renovate bot requested review from jamengual and removed request for a team April 14, 2024 09:28
@renovate renovate bot enabled auto-merge (squash) April 14, 2024 09:28
@github-actions github-actions bot added the dependencies PRs that update a dependency file label Apr 14, 2024
@renovate renovate bot changed the title chore(deps): update module golang.org/x/net to v0.23.0 [security] (release-0.27) chore(deps): update module golang.org/x/net to v0.23.0 [security] (release-0.27) - autoclosed Apr 18, 2024
@renovate renovate bot closed this Apr 18, 2024
auto-merge was automatically disabled April 18, 2024 17:10

Pull request was closed

@renovate renovate bot deleted the renovate/release-0.27-go-golang.org/x/net-vulnerability branch April 18, 2024 17:10
@renovate renovate bot changed the title chore(deps): update module golang.org/x/net to v0.23.0 [security] (release-0.27) - autoclosed chore(deps): update module golang.org/x/net to v0.23.0 [security] (release-0.27) Apr 21, 2024
@renovate renovate bot reopened this Apr 21, 2024
@renovate renovate bot restored the renovate/release-0.27-go-golang.org/x/net-vulnerability branch April 21, 2024 09:14
@renovate renovate bot enabled auto-merge (squash) April 21, 2024 09:15
@renovate renovate bot force-pushed the renovate/release-0.27-go-golang.org/x/net-vulnerability branch 2 times, most recently from fb7b1aa to 1ff4ec5 Compare April 24, 2024 22:44
@renovate renovate bot force-pushed the renovate/release-0.27-go-golang.org/x/net-vulnerability branch from 1ff4ec5 to 28a876d Compare April 25, 2024 01:00
@renovate renovate bot merged commit 1594079 into release-0.27 Apr 25, 2024
24 checks passed
@renovate renovate bot deleted the renovate/release-0.27-go-golang.org/x/net-vulnerability branch April 25, 2024 01:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies PRs that update a dependency file security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants