CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 1CVE-2022-41717 – Excessive memory growth in net/http and golang.org/x/net/http2
https://notcve.org/view.php?id=CVE-2022-41717
08 Dec 2022 — An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. Un atacante puede provocar un crecimiento excesivo de la memoria en un servidor Go que acepta solicitudes HTTP/2. Las conexiones del servidor HTTP/2 contienen un caché de c... • https://github.com/domdom82/h2conn-exploit • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-41720 – Restricted file access on Windows in os and net/http
https://notcve.org/view.php?id=CVE-2022-41720
07 Dec 2022 — On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. • https://go.dev/cl/455716 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-41716 – Unsanitized NUL in environment variables on Windows in syscall and os/exec
https://notcve.org/view.php?id=CVE-2022-41716
02 Nov 2022 — Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D". Debido a valores NUL no sanitizados, los atacantes pueden configu... • https://go.dev/cl/446916 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-2879 – Unbounded memory consumption when reading headers in archive/tar
https://notcve.org/view.php?id=CVE-2022-2879
14 Oct 2022 — Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. Reader.Read no establece un límite en el tamaño máximo de los encabezados de los archivos. Un archivo diseñado de forma maliciosa podía causar que Read asignara cantidades ilimitadas de memoria, causando potencialmente el agotami... • https://go.dev/cl/439355 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-2880 – Incorrect sanitization of forwarded query parameters in net/http/httputil
https://notcve.org/view.php?id=CVE-2022-2880
14 Oct 2022 — Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not pa... • https://go.dev/cl/432976 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41715 – Memory exhaustion when compiling regular expressions in regexp/syntax
https://notcve.org/view.php?id=CVE-2022-41715
14 Oct 2022 — Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regu... • https://go.dev/cl/439356 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-32190 – Failure to strip relative path components in net/url
https://notcve.org/view.php?id=CVE-2022-32190
13 Sep 2022 — JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result. JoinPath y URL.JoinPath no eliminan los elementos de ruta ../ anexados a una ruta relativa. • https://go.dev/cl/423514 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-27664 – golang: net/http: handle server errors after sending GOAWAY
https://notcve.org/view.php?id=CVE-2022-27664
06 Sep 2022 — In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. En net/http en Go versiones anteriores a 1.18.6 y 1.19.x anteriores a 1.19.1, los atacantes pueden causar una denegación de servicio porque una conexión HTTP/2 puede colgarse durante el cierre si el apagado fue adelantado por un error fatal. A flaw was found in the golang package. In net/http in Go, attackers can c... • https://groups.google.com/g/golang-announce • CWE-400: Uncontrolled Resource Consumption •