Описание
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
A flaw was found in the net package of Go (golang). When running on Windows, the Dial and LookupPort functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.
Отчет
This denial of service flaw exists within the Go net package, specifically impacting applications when executed on Microsoft Windows operating systems. Red Hat Product Security has rated this flaw as a Moderate as Red Hat products primarily deploy Go applications on Linux-based environments. Customers operating Go applications, including those bundled with Red Hat products, within a Windows environment should assess their exposure to this flaw.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-rhel9 | Not affected | ||
| Builds for Red Hat OpenShift | openshift-builds/openshift-builds-waiters-rhel9 | Affected | ||
| cert-manager Operator for Red Hat OpenShift | cert-manager/jetstack-cert-manager-rhel9 | Affected | ||
| Compliance Operator | compliance/openshift-compliance-operator-bundle | Not affected | ||
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9-operator | Affected | ||
| Confidential Compute Attestation | confidential-compute-attestation-tech-preview/trustee-rhel9-operator | Affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-monitor-rhel9 | Affected | ||
| Cryostat 4 | cryostat/cryostat-grafana-dashboard-rhel9 | Affected | ||
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Out of support scope | ||
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
Panic in Dial and LookupPort when handling NUL byte on Windows in net
The Dial and LookupPort functions panic on Windows when provided with ...
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
EPSS
7.5 High
CVSS3