Описание
Security update for go1.21
This update for go1.21 fixes the following issues:
Updated to version 1.21.12 (bsc#1212475):
- CVE-2024-24791: Fixed a potential denial of service due to improper handling of HTTP 100-continue headers (bsc#1227314).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise Module for Development Tools 15 SP5
SUSE Linux Enterprise Module for Development Tools 15 SP6
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
openSUSE Leap 15.5
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2024:2308-1
- E-Mail link for SUSE-SU-2024:2308-1
- SUSE Security Ratings
- SUSE Bug 1212475
- SUSE Bug 1227314
- SUSE CVE CVE-2024-24791 page
Описание
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
Затронутые продукты
Ссылки
- CVE-2024-24791
- SUSE Bug 1227314