Skip to content

Commit 2872628

Browse files
tatianabtatianab
committed
data/reports: add GO-2023-2102.yaml
Aliases: CVE-2023-44487, CVE-2023-39325 Updates #2102 Change-Id: If4004559d848991502c667c4c4c4b8e1fba3c3ea Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/534240 Reviewed-by: Damien Neil <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
1 parent f75fb61 commit 2872628

File tree

3 files changed

+328
-0
lines changed

3 files changed

+328
-0
lines changed

‎data/cve/v5/GO-2023-2102.json

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2023-39325"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "HTTP/2 rapid reset can cause excessive work in net/http",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go standard library",
22+
"product": "net/http",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "net/http",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.20.10",
29+
"status": "affected",
30+
"versionType": "semver"
31+
},
32+
{
33+
"version": "1.21.0-0",
34+
"lessThan": "1.21.3",
35+
"status": "affected",
36+
"versionType": "semver"
37+
}
38+
],
39+
"programRoutines": [
40+
{
41+
"name": "http2serverConn.serve"
42+
},
43+
{
44+
"name": "http2serverConn.processHeaders"
45+
},
46+
{
47+
"name": "http2serverConn.upgradeRequest"
48+
},
49+
{
50+
"name": "http2serverConn.runHandler"
51+
},
52+
{
53+
"name": "ListenAndServe"
54+
},
55+
{
56+
"name": "ListenAndServeTLS"
57+
},
58+
{
59+
"name": "Serve"
60+
},
61+
{
62+
"name": "ServeTLS"
63+
},
64+
{
65+
"name": "Server.ListenAndServe"
66+
},
67+
{
68+
"name": "Server.ListenAndServeTLS"
69+
},
70+
{
71+
"name": "Server.Serve"
72+
},
73+
{
74+
"name": "Server.ServeTLS"
75+
},
76+
{
77+
"name": "http2Server.ServeConn"
78+
}
79+
],
80+
"defaultStatus": "unaffected"
81+
},
82+
{
83+
"vendor": "golang.org/x/net",
84+
"product": "golang.org/x/net/http2",
85+
"collectionURL": "https://pkg.go.dev",
86+
"packageName": "golang.org/x/net/http2",
87+
"versions": [
88+
{
89+
"version": "0",
90+
"lessThan": "0.17.0",
91+
"status": "affected",
92+
"versionType": "semver"
93+
}
94+
],
95+
"programRoutines": [
96+
{
97+
"name": "serverConn.serve"
98+
},
99+
{
100+
"name": "serverConn.processHeaders"
101+
},
102+
{
103+
"name": "serverConn.upgradeRequest"
104+
},
105+
{
106+
"name": "serverConn.runHandler"
107+
},
108+
{
109+
"name": "Server.ServeConn"
110+
}
111+
],
112+
"defaultStatus": "unaffected"
113+
}
114+
],
115+
"problemTypes": [
116+
{
117+
"descriptions": [
118+
{
119+
"lang": "en",
120+
"description": "CWE-400: Uncontrolled Resource Consumption"
121+
}
122+
]
123+
}
124+
],
125+
"references": [
126+
{
127+
"url": "https://go.dev/issue/63417"
128+
},
129+
{
130+
"url": "https://go.dev/cl/534215"
131+
},
132+
{
133+
"url": "https://go.dev/cl/534235"
134+
},
135+
{
136+
"url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
137+
},
138+
{
139+
"url": "https://pkg.go.dev/vuln/GO-2023-2102"
140+
}
141+
]
142+
}
143+
}
144+
}

‎data/osv/GO-2023-2102.json

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2023-2102",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2023-44487",
8+
"CVE-2023-39325"
9+
],
10+
"summary": "HTTP/2 rapid reset can cause excessive work in net/http",
11+
"details": "A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.\n\nWith the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.\n\nThis issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.\n\nThe default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "stdlib",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.20.10"
27+
},
28+
{
29+
"introduced": "1.21.0-0"
30+
},
31+
{
32+
"fixed": "1.21.3"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "net/http",
41+
"symbols": [
42+
"ListenAndServe",
43+
"ListenAndServeTLS",
44+
"Serve",
45+
"ServeTLS",
46+
"Server.ListenAndServe",
47+
"Server.ListenAndServeTLS",
48+
"Server.Serve",
49+
"Server.ServeTLS",
50+
"http2Server.ServeConn",
51+
"http2serverConn.processHeaders",
52+
"http2serverConn.runHandler",
53+
"http2serverConn.serve",
54+
"http2serverConn.upgradeRequest"
55+
]
56+
}
57+
]
58+
}
59+
},
60+
{
61+
"package": {
62+
"name": "golang.org/x/net",
63+
"ecosystem": "Go"
64+
},
65+
"ranges": [
66+
{
67+
"type": "SEMVER",
68+
"events": [
69+
{
70+
"introduced": "0"
71+
},
72+
{
73+
"fixed": "0.17.0"
74+
}
75+
]
76+
}
77+
],
78+
"ecosystem_specific": {
79+
"imports": [
80+
{
81+
"path": "golang.org/x/net/http2",
82+
"symbols": [
83+
"Server.ServeConn",
84+
"serverConn.processHeaders",
85+
"serverConn.runHandler",
86+
"serverConn.serve",
87+
"serverConn.upgradeRequest"
88+
]
89+
}
90+
]
91+
}
92+
}
93+
],
94+
"references": [
95+
{
96+
"type": "REPORT",
97+
"url": "https://go.dev/issue/63417"
98+
},
99+
{
100+
"type": "FIX",
101+
"url": "https://go.dev/cl/534215"
102+
},
103+
{
104+
"type": "FIX",
105+
"url": "https://go.dev/cl/534235"
106+
},
107+
{
108+
"type": "WEB",
109+
"url": "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"
110+
}
111+
],
112+
"database_specific": {
113+
"url": "https://pkg.go.dev/vuln/GO-2023-2102"
114+
}
115+
}

‎data/reports/GO-2023-2102.yaml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
id: GO-2023-2102
2+
modules:
3+
- module: std
4+
versions:
5+
- fixed: 1.20.10
6+
- introduced: 1.21.0-0
7+
fixed: 1.21.3
8+
vulnerable_at: 1.21.2
9+
packages:
10+
- package: net/http
11+
symbols:
12+
- http2serverConn.serve
13+
- http2serverConn.processHeaders
14+
- http2serverConn.upgradeRequest
15+
- http2serverConn.runHandler
16+
derived_symbols:
17+
- ListenAndServe
18+
- ListenAndServeTLS
19+
- Serve
20+
- ServeTLS
21+
- Server.ListenAndServe
22+
- Server.ListenAndServeTLS
23+
- Server.Serve
24+
- Server.ServeTLS
25+
- http2Server.ServeConn
26+
- module: golang.org/x/net
27+
versions:
28+
- fixed: 0.17.0
29+
vulnerable_at: 0.16.0
30+
packages:
31+
- package: golang.org/x/net/http2
32+
symbols:
33+
- serverConn.serve
34+
- serverConn.processHeaders
35+
- serverConn.upgradeRequest
36+
- serverConn.runHandler
37+
derived_symbols:
38+
- Server.ServeConn
39+
summary: HTTP/2 rapid reset can cause excessive work in net/http
40+
description: |-
41+
A malicious HTTP/2 client which rapidly creates requests and immediately resets
42+
them can cause excessive server resource consumption. While the total number of
43+
requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting
44+
an in-progress request allows the attacker to create a new request while the
45+
existing one is still executing.
46+
47+
With the fix applied, HTTP/2 servers now bound the number of simultaneously
48+
executing handler goroutines to the stream concurrency limit
49+
(MaxConcurrentStreams). New requests arriving when at the limit (which can only
50+
happen after the client has reset an existing, in-flight request) will be queued
51+
until a handler exits. If the request queue grows too large, the server will
52+
terminate the connection.
53+
54+
This issue is also fixed in golang.org/x/net/http2 for users manually
55+
configuring HTTP/2.
56+
57+
The default stream concurrency limit is 250 streams (requests) per HTTP/2
58+
connection. This value may be adjusted using the golang.org/x/net/http2 package;
59+
see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
60+
cves:
61+
- CVE-2023-44487
62+
references:
63+
- report: https://go.dev/issue/63417
64+
- fix: https://go.dev/cl/534215
65+
- fix: https://go.dev/cl/534235
66+
- web: https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ
67+
cve_metadata:
68+
id: CVE-2023-39325
69+
cwe: 'CWE-400: Uncontrolled Resource Consumption'

0 commit comments

Comments
 (0)