Уязвимость DoS атаки через избыточное потребление ресурсов в пакетах "net/http" и "mime/multipart"
Описание
В пакетах net/http и mime/multipart реализована возможность DoS атаки через избыточное потребление ресурсов. При разборе multipart форм с помощью метода mime/multipart.Reader.ReadForm может потребляться практически неограниченное количество памяти и файлов на диске. Это также затрагивает парсинг форм в пакете net/http с методами Request: FormFile, FormValue, ParseMultipartForm и PostFormValue. Метод ReadForm принимает параметр maxMemory и заявлено, что он хранит "до maxMemory байт +10MB (зарезервированы для частей без файлов) в памяти". Части файлов, которые не могут быть сохранены в памяти, сохраняются на диске во временных файлах. Неконфигурируемый резерв в 10MB для частей без файлов чрезмерно велик и сам по себе может открыть вектор для DoS атаки. Однако, метод ReadForm некорректно учитывает всю память, потребляемую разобранной формой, включая такие элементы, как накладные расходы на запись в карту (map entry overhead), имена частей и MIME заголовки, что позволяет вредоносно сформированной форме потреблять значительно больше 10MB. Кроме того, в ReadForm отсутствует ограничение на количество файлов, создаваемых на диске.
Тип уязвимости
DoS атака
Ссылки
- PatchRelease Notes
- Issue TrackingPatchVendor Advisory
- Mailing ListVendor Advisory
- Vendor Advisory
- PatchRelease Notes
- Issue TrackingPatchVendor Advisory
- Mailing ListVendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.5 High
CVSS3
Дефекты
Связанные уязвимости
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files...
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files...
A denial of service is possible from excessive resource consumption in ...
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files...
Уязвимость библиотек net/http и mime/multipart средства разработки GoLang, используемых в прикладном программном обеспечении ППО "Аврора Центр", позволяющая нарушителю выполнить атаку типа "отказ в обслуживании
EPSS
7.5 High
CVSS3