[24.0 backport] vendor: golang.org/x/net v0.17.0 #4609
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
full diff: golang/sync@v0.1.0...v0.3.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 1554b49) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: golang/sys@v0.8.0...v0.10.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit ffea694) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: golang/crypto@v0.3.0...v0.9.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit c9d56b8) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: golang/sys@v0.10.0...v0.13.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 48655f7) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: golang/text@v0.9.0...v0.13.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit ac30778) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- term: consistently return zeroes on GetSize error full diff: golang/term@v0.8.0...v0.13.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 392db31) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: golang/crypto@v0.9.0...v0.14.0 Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit 612a171) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: golang/net@v0.10.0...v0.17.0 This fixes the same CVE as go1.21.3 and go1.20.10; - net/http: rapid stream resets can cause excessive work A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit. New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 v0.17.0, for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. This is CVE-2023-39325 and Go issue https://go.dev/issue/63417. This is also tracked by CVE-2023-44487. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit a27466f) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
vvoland
approved these changes
Oct 19, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
backports of:
vendor: golang.org/x/sync v0.3.0
full diff: golang/sync@v0.1.0...v0.3.0
vendor: golang.org/x/sys v0.10.0
full diff: golang/sys@v0.8.0...v0.10.0
vendor: golang.org/x/crypto v0.9.0
full diff: golang/crypto@v0.3.0...v0.9.0
vendor: golang.org/x/sys v0.13.0
full diff: golang/sys@v0.10.0...v0.13.0
vendor: golang.org/x/text v0.13.0
full diff: golang/text@v0.9.0...v0.13.0
vendor: golang.org/x/term v0.13.0
full diff: golang/term@v0.8.0...v0.13.0
vendor: golang.org/x/crypto v0.14.0
full diff: golang/crypto@v0.9.0...v0.14.0
vendor: golang.org/x/net v0.17.0
full diff: golang/net@v0.10.0...v0.17.0
This fixes the same CVE as go1.21.3 and go1.20.10;
net/http: rapid stream resets can cause excessive work
A malicious HTTP/2 client which rapidly creates requests and
immediately resets them can cause excessive server resource consumption.
While the total number of requests is bounded to the
http2.Server.MaxConcurrentStreams setting, resetting an in-progress
request allows the attacker to create a new request while the existing
one is still executing.
HTTP/2 servers now bound the number of simultaneously executing
handler goroutines to the stream concurrency limit. New requests
arriving when at the limit (which can only happen after the client
has reset an existing, in-flight request) will be queued until a
handler exits. If the request queue grows too large, the server
will terminate the connection.
This issue is also fixed in golang.org/x/net/http2 v0.17.0,
for users manually configuring HTTP/2.
The default stream concurrency limit is 250 streams (requests)
per HTTP/2 connection. This value may be adjusted using the
golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
setting and the ConfigureServer function.
This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
This is also tracked by CVE-2023-44487.
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)