Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update module golang.org/x/net to v0.23.0 [SECURITY] #249

Merged
merged 1 commit into from
May 7, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 19, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
golang.org/x/net v0.22.0 -> v0.23.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-45288

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Copy link

codecov bot commented Apr 19, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 91.49%. Comparing base (8ba5629) to head (e0b9905).

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #249      +/-   ##
==========================================
+ Coverage   91.38%   91.49%   +0.11%     
==========================================
  Files          38       38              
  Lines        1799     1799              
==========================================
+ Hits         1644     1646       +2     
+ Misses        135      133       -2     
  Partials       20       20              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@at-wat at-wat merged commit 0f3ef54 into master May 7, 2024
21 checks passed
@at-wat at-wat deleted the renovate/go-golang.org/x/net-vulnerability branch May 7, 2024 00:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant