Описание
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
Отчет
Red Hat evaluates this vulnerability as having an Important severity because unauthenticated remote attackers can target exposed Go services over the network to trigger severe denial-of-service conditions or validation discrepancies without requiring elevated privileges. Across standard Red Hat environments—including OpenShift Container Platform and Red Hat Enterprise Linux container tools—many components rely on the core Go runtime to process user-supplied addresses and endpoints. Although improper handling of malformed host segments in web addresses can disrupt network-facing daemons, the vulnerability cannot be leveraged for arbitrary code execution or data leakage, keeping the risk bounded within the Important classification.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-rhel9 | Affected | ||
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9-operator | Affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-monitor-rhel9 | Will not fix | ||
| Deployment Validation Operator | dvo/deployment-validation-rhel8-operator | Affected | ||
| ExternalDNS Operator | edo/external-dns-rhel8 | Affected | ||
| ExternalDNS Operator | edo/external-dns-rhel9 | Affected | ||
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-rhel9 | Will not fix | ||
| Fence Agents Remediation Operator | workload-availability/fence-agents-remediation-rhel8-operator | Affected | ||
| File Integrity Operator | compliance/openshift-compliance-operator-bundle | Affected | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9-operator | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
url.Parse insufficiently validated the host/authority component and ac ...
EPSS
7.5 High
CVSS3