Описание
Security update for go1.21
This update for go1.21 fixes the following issues:
- CVE-2023-45288: Fixed denial of service via HTTP/2 continuation frames (bsc#1221400)
Other changes:
- go minor release upgrade to 1.21.9 (bsc#1212475)
Список пакетов
Container bci/golang:1.21
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise Module for Development Tools 15 SP5
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
openSUSE Leap 15.5
Ссылки
- Link for SUSE-SU-2024:1122-1
- E-Mail link for SUSE-SU-2024:1122-1
- SUSE Security Ratings
- SUSE Bug 1212475
- SUSE Bug 1221400
- SUSE CVE CVE-2023-45288 page
Описание
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
Затронутые продукты
Ссылки
- CVE-2023-45288
- SUSE Bug 1221400