Repository navigation
net/http: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) #57855
Description
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
This issue is also fixed in golang.org/x/net/http2, for users manually configuring HTTP/2.
Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
This is a PRIVATE issue for CVE-2022-41723, tracked in http://b/262602307 and fixed by http://tg/1688184.
Activity
rolandshoemaker commentedon Feb 6, 2023
@gopherbot please open backport issues.
gopherbot commentedon Feb 6, 2023
Backport issue(s) opened: #58355 (for 1.19), #58356 (for 1.20).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Feb 14, 2023
Change https://go.dev/cl/468118 mentions this issue:
[release-branch.go1.19] net/http: update bundled golang.org/x/net/http2gopherbot commentedon Feb 14, 2023
Change https://go.dev/cl/468122 mentions this issue:
[release-branch.go1.20] net/http: update bundled golang.org/x/net/http2gopherbot commentedon Feb 14, 2023
Change https://go.dev/cl/468135 mentions this issue:
http2/hpack: avoid quadratic complexity in hpack decoding[release-branch.go1.20] net/http: update bundled golang.org/x/net/http2
[release-branch.go1.19] net/http: update bundled golang.org/x/net/http2
gopherbot commentedon Feb 14, 2023
Change https://go.dev/cl/468295 mentions this issue:
all: update vendored golang.org/x/net[-]security: fix CVE-2022-41723[/-][+]net/http: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)[/+]9 remaining items
Update golang.org/x/net from v0.4.0 (#81)
Updating our dependencies for security purposes
all: update vendored golang.org/x/net
[release-branch.go1.20] net/http: update bundled golang.org/x/net/http2
[release-branch.go1.20] all: update vendored golang.org/x/net
benjsmi commentedon Mar 3, 2023
So, looking at https://pkg.go.dev/vuln/GO-2023-1571, it looks like the
net/httpis impacted even if or even though you update/upgrade any references to golang.org/x/net to v0.7.0... Right?If we upgrade golang.org/x/net to v0.7.0 and leave Golang at, say, v1.18.x, are we still vulnerable to this?
neild commentedon Mar 3, 2023
If you upgrade
golang.org/x/netto v0.7.0 and usehttp2.ConfigureServers/http2.ConfigureTransportto override the bundled HTTP/2, then you are not vulnerable.Unfortunately, we don't have a good way for govulncheck to detect the case where the standard library's bundled HTTP/2 support is present but unused.
Update golang.org/x/net to fix CVE-2022-4172
Update golang.org/x/net to fix CVE-2022-4172
Update golang.org/x/net to fix CVE-2022-4173
Update golang.org/x/net to fix CVE-2022-41723 (#4470)
Update golang.org/x/net to fix CVE-2022-41723 (#4470)
bisonliao commentedon Apr 19, 2023
I use go 1.15，how should I do ? upgrade my go to 1.21? It will be a horrible mission. Can I just upgrade net package ? thank you.