Описание
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| golang-golang-x-text | fixed | 0.3.8-1 | package | |
| golang-golang-x-text | no-dsa | bullseye | package | |
| golang-x-text | removed | package | ||
| golang-x-text | postponed | buster | package |
Примечания
https://groups.google.com/g/golang-dev/c/qfPIly0X7aU
https://go.dev/issue/56152
https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c (v0.3.8)
EPSS
Связанные уязвимости
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
golang.org/x/text/language Denial of service via crafted Accept-Language header
EPSS