Merge pull request #145 from cgoncalves/CVE_2023-39325-fix

Fix HTTP/2 disablement
k8snetworkplumbingwg · Nov 13, 2023 · 6926642 · 6926642
2 parents 97ed980 + 789fe87
commit 6926642
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/cmd/webhook/main.go b/cmd/webhook/main.go
@@ -169,11 +169,12 @@ func main() {
 				},
 				GetCertificate: keyPair.GetCertificateFunc(),
 			},
+			// CVE-2023-39325 https://github.com/golang/go/issues/63417
+			TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
 		}
 
-		// CVE-2023-39325 https://github.com/golang/go/issues/63417
-		if !*enableHTTP2 {
-			httpServer.TLSConfig.NextProtos = []string{"http/1.1"}
+		if *enableHTTP2 {
+			httpServer.TLSNextProto = nil
 		}
 
 		err := httpServer.ListenAndServeTLS("", "")