CVE-2022-41717

NameCVE-2022-41717
DescriptionAn attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-1.11 (PTS)buster (security), buster, buster (lts)1.11.6-1+deb10u7vulnerable
golang-1.15 (PTS)bullseye1.15.15-1~deb11u4vulnerable
golang-1.19 (PTS)bookworm1.19.8-2fixed
golang-1.7 (PTS)stretch (security), stretch (lts), stretch1.7.4-2+deb9u5vulnerable
golang-golang-x-net (PTS)bullseye1:0.0+git20210119.5f4716e+dfsg-4vulnerable
bookworm1:0.7.0+dfsg-1fixed
sid, trixie1:0.27.0-1fixed
golang-golang-x-net-dev (PTS)stretch (security), stretch (lts), stretch1:0.0+git20161013.8b4af36+dfsg-3+deb9u1vulnerable
buster1:0.0+git20181201.351d144+dfsg-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-1.11source(unstable)(unfixed)
golang-1.15source(unstable)(unfixed)
golang-1.18source(unstable)1.18.9-1
golang-1.19source(unstable)1.19.4-1
golang-1.7source(unstable)(unfixed)
golang-golang-x-netsource(unstable)1:0.4.0+dfsg-1
golang-golang-x-net-devsourcestretch(unfixed)end-of-life
golang-golang-x-net-devsource(unstable)(unfixed)

Notes

[bullseye] - golang-1.15 <no-dsa> (Minor issue)
[buster] - golang-1.11 <postponed> (Limited support, follow bullseye DSAs/point-releases)
[bullseye] - golang-golang-x-net <no-dsa> (Minor issue)
[buster] - golang-golang-x-net-dev <postponed> (Limited support, follow bullseye DSAs/point-releases)
https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU
https://go.dev/issue/56350
https://github.com/golang/go/commit/618120c165669c00a1606505defea6ca755cdc27 (go1.19.4)
https://github.com/golang/go/commit/76cad4edc29d28432a7a0aa27e87385d3d7db7a1 (go1.18.9)
https://github.com/golang/net/commit/1e63c2f08a10a150fa02c50ece89b340ae64efe4 (v0.4.0)
[stretch] - golang-1.7 <postponed> (Limited support, follow DLAs)

Search for package or bug name: Reporting problems