Skip to content

Commit 92d9286

Browse files
tatianabTatiana Bradley
tatianab
authored and
Tatiana Bradley
committed
data/reports: add GO-2022-1144.yaml
Aliases: CVE-2022-41717 Updates #1144 Change-Id: I7ac8c7020a91486cea5dbf5895f7566b6cd94919 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/456057 Reviewed-by: Tatiana Bradley <[email protected]> TryBot-Result: Gopher Robot <[email protected]> Reviewed-by: Damien Neil <[email protected]> Run-TryBot: Tatiana Bradley <[email protected]>
1 parent aad2780 commit 92d9286

File tree

3 files changed

+294
-0
lines changed

3 files changed

+294
-0
lines changed

‎data/cve/v5/GO-2022-1144.json

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2022-41717"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"descriptions": [
13+
{
14+
"lang": "en",
15+
"value": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."
16+
}
17+
],
18+
"affected": [
19+
{
20+
"vendor": "Go standard library",
21+
"product": "net/http",
22+
"collectionURL": "https://pkg.go.dev",
23+
"packageName": "net/http",
24+
"versions": [
25+
{
26+
"version": "0",
27+
"lessThan": "1.18.9",
28+
"status": "affected",
29+
"versionType": "semver"
30+
},
31+
{
32+
"version": "1.19.0",
33+
"lessThan": "1.19.4",
34+
"status": "affected",
35+
"versionType": "semver"
36+
}
37+
],
38+
"programRoutines": [
39+
{
40+
"name": "http2serverConn.canonicalHeader"
41+
},
42+
{
43+
"name": "ListenAndServe"
44+
},
45+
{
46+
"name": "ListenAndServeTLS"
47+
},
48+
{
49+
"name": "Serve"
50+
},
51+
{
52+
"name": "ServeTLS"
53+
},
54+
{
55+
"name": "Server.ListenAndServe"
56+
},
57+
{
58+
"name": "Server.ListenAndServeTLS"
59+
},
60+
{
61+
"name": "Server.Serve"
62+
},
63+
{
64+
"name": "Server.ServeTLS"
65+
},
66+
{
67+
"name": "http2Server.ServeConn"
68+
}
69+
],
70+
"defaultStatus": "unaffected"
71+
},
72+
{
73+
"vendor": "golang.org/x/net",
74+
"product": "golang.org/x/net/http2",
75+
"collectionURL": "https://pkg.go.dev",
76+
"packageName": "golang.org/x/net/http2",
77+
"versions": [
78+
{
79+
"version": "0",
80+
"lessThan": "0.4.0",
81+
"status": "affected",
82+
"versionType": "semver"
83+
}
84+
],
85+
"programRoutines": [
86+
{
87+
"name": "serverConn.canonicalHeader"
88+
},
89+
{
90+
"name": "Server.ServeConn"
91+
}
92+
],
93+
"defaultStatus": "unaffected"
94+
}
95+
],
96+
"problemTypes": [
97+
{
98+
"descriptions": [
99+
{
100+
"lang": "en",
101+
"description": "CWE 400: Uncontrolled Resource Consumption"
102+
}
103+
]
104+
}
105+
],
106+
"references": [
107+
{
108+
"url": "https://go.dev/issue/56350"
109+
},
110+
{
111+
"url": "https://go.dev/cl/455717"
112+
},
113+
{
114+
"url": "https://go.dev/cl/455635"
115+
},
116+
{
117+
"url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
118+
},
119+
{
120+
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
121+
}
122+
],
123+
"credits": [
124+
{
125+
"lang": "en",
126+
"value": "Josselin Costanzi"
127+
}
128+
]
129+
}
130+
}
131+
}

‎data/osv/GO-2022-1144.json

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2022-1144",
4+
"published": "0001-01-01T00:00:00Z",
5+
"modified": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2022-41717"
8+
],
9+
"details": "An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.\n\nHTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.",
10+
"affected": [
11+
{
12+
"package": {
13+
"name": "stdlib",
14+
"ecosystem": "Go"
15+
},
16+
"ranges": [
17+
{
18+
"type": "SEMVER",
19+
"events": [
20+
{
21+
"introduced": "0"
22+
},
23+
{
24+
"fixed": "1.18.9"
25+
},
26+
{
27+
"introduced": "1.19.0"
28+
},
29+
{
30+
"fixed": "1.19.4"
31+
}
32+
]
33+
}
34+
],
35+
"database_specific": {
36+
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
37+
},
38+
"ecosystem_specific": {
39+
"imports": [
40+
{
41+
"path": "net/http",
42+
"symbols": [
43+
"ListenAndServe",
44+
"ListenAndServeTLS",
45+
"Serve",
46+
"ServeTLS",
47+
"Server.ListenAndServe",
48+
"Server.ListenAndServeTLS",
49+
"Server.Serve",
50+
"Server.ServeTLS",
51+
"http2Server.ServeConn",
52+
"http2serverConn.canonicalHeader"
53+
]
54+
}
55+
]
56+
}
57+
},
58+
{
59+
"package": {
60+
"name": "golang.org/x/net",
61+
"ecosystem": "Go"
62+
},
63+
"ranges": [
64+
{
65+
"type": "SEMVER",
66+
"events": [
67+
{
68+
"introduced": "0"
69+
},
70+
{
71+
"fixed": "0.4.0"
72+
}
73+
]
74+
}
75+
],
76+
"database_specific": {
77+
"url": "https://pkg.go.dev/vuln/GO-2022-1144"
78+
},
79+
"ecosystem_specific": {
80+
"imports": [
81+
{
82+
"path": "golang.org/x/net/http2",
83+
"symbols": [
84+
"Server.ServeConn",
85+
"serverConn.canonicalHeader"
86+
]
87+
}
88+
]
89+
}
90+
}
91+
],
92+
"references": [
93+
{
94+
"type": "REPORT",
95+
"url": "https://go.dev/issue/56350"
96+
},
97+
{
98+
"type": "FIX",
99+
"url": "https://go.dev/cl/455717"
100+
},
101+
{
102+
"type": "FIX",
103+
"url": "https://go.dev/cl/455635"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"
108+
}
109+
],
110+
"credits": [
111+
{
112+
"name": "Josselin Costanzi"
113+
}
114+
]
115+
}

‎data/reports/GO-2022-1144.yaml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
modules:
2+
- module: std
3+
versions:
4+
- fixed: 1.18.9
5+
- introduced: 1.19.0
6+
fixed: 1.19.4
7+
vulnerable_at: 1.19.3
8+
packages:
9+
- package: net/http
10+
symbols:
11+
- http2serverConn.canonicalHeader
12+
derived_symbols:
13+
- ListenAndServe
14+
- ListenAndServeTLS
15+
- Serve
16+
- ServeTLS
17+
- Server.ListenAndServe
18+
- Server.ListenAndServeTLS
19+
- Server.Serve
20+
- Server.ServeTLS
21+
- http2Server.ServeConn
22+
- module: golang.org/x/net
23+
versions:
24+
- fixed: 0.4.0
25+
vulnerable_at: 0.3.0
26+
packages:
27+
- package: golang.org/x/net/http2
28+
symbols:
29+
- serverConn.canonicalHeader
30+
derived_symbols:
31+
- Server.ServeConn
32+
description: |
33+
An attacker can cause excessive memory growth in a Go server accepting
34+
HTTP/2 requests.
35+
36+
HTTP/2 server connections contain a cache of HTTP header keys sent by the
37+
client. While the total number of entries in this cache is capped, an
38+
attacker sending very large keys can cause the server to allocate
39+
approximately 64 MiB per open connection.
40+
credit: Josselin Costanzi
41+
references:
42+
- report: https://go.dev/issue/56350
43+
- fix: https://go.dev/cl/455717
44+
- fix: https://go.dev/cl/455635
45+
- web: https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ
46+
cve_metadata:
47+
id: CVE-2022-41717
48+
cwe: 'CWE 400: Uncontrolled Resource Consumption'

0 commit comments

Comments
 (0)