Описание
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
Отчет
This is an Important denial of service vulnerability in the net/mail package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | rhai/assisted-installer-rhel9 | Affected | ||
| cert-manager Operator for Red Hat OpenShift | cert-manager/jetstack-cert-manager-rhel9 | Affected | ||
| Confidential Compute Attestation | build-of-trustee/trustee-rhel9-operator | Affected | ||
| Confidential Compute Attestation | confidential-compute-attestation-tech-preview/trustee-rhel9-operator | Affected | ||
| Confidential Compute Attestation | openshift-sandboxed-containers/osc-monitor-rhel9 | Affected | ||
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Fix deferred | ||
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 | Not affected | ||
| External Secrets Operator for Red Hat OpenShift | external-secrets-operator/external-secrets-rhel9 | Will not fix | ||
| File Integrity Operator | compliance/openshift-compliance-operator-bundle | Affected | ||
| Gatekeeper 3 | gatekeeper/gatekeeper-rhel9-operator | Under investigation |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
Pathological inputs could cause DoS through consumePhrase when parsing ...
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
7.5 High
CVSS3