Описание
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
A flaw was found in golang. An attacker can craft an input to ParseFragment within parse.go that would cause it to enter an infinite loop and never return. The greatest threat to the system is of availability.
Отчет
Red Hat Developer Tools go-toolset-1.14-golang not affected because the vulnerable code is not shipped. This vulnerability within golang and buildah shipped with RHEL-7 are out of support scope. For more information on Red Hat's support scope, visit: https://access.redhat.com/support/policy/updates/errata For RHEL-8's go-toolset:rhel8/golang, container-tools:1.0/buildah, container-tools:2.0/buildah, and container-tools:rhel8/buildah, the affected function is only used in e2e tests. For RHEL-9's golang and buildah, the affected function is only used in e2e tests. Red Hat Openshift Container Storage has dependencies with the affected code, however, low priority trackers were filed as the vulnerable code is not shipped or used.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel8-operator | Will not fix | ||
| OpenShift Serverless | cli | Not affected | ||
| OpenShift Serverless | knative-eventing | Not affected | ||
| OpenShift Serverless | knative-serving | Not affected | ||
| OpenShift Service Mesh 2.0 | servicemesh | Affected | ||
| Red Hat Ceph Storage 2 | golang | Out of support scope | ||
| Red Hat Ceph Storage 2 | grafana | Out of support scope | ||
| Red Hat Ceph Storage 3 | golang | Out of support scope | ||
| Red Hat Ceph Storage 3 | golang-github-prometheus-node_exporter | Out of support scope | ||
| Red Hat Ceph Storage 3 | grafana | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows atta ...
golang.org/x/net/html Infinite Loop vulnerability
EPSS
7.5 High
CVSS3