[24.0 backport] vendor: golang.org/x/net v0.17.0 #46671
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
full diff: golang/crypto@v0.2.0...v0.3.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 7b66ae1) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/sys@v0.8.0...v0.10.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit a046616) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/crypto@v0.3.0...v0.9.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 9670db3) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/text@v0.9.0...v0.11.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 87de23a) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/net@v0.10.0...v0.13.0 full diff: golang/crypto@v0.9.0...v0.11.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 2edb858) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/sys@v0.10.0...v0.13.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit bc33c27) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/text@v0.11.0...v0.13.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 0679ae9) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/crypto@v0.11.0...v0.14.0 Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 1946aea) Signed-off-by: Sebastiaan van Stijn <[email protected]>
full diff: golang/net@v0.13.0...v0.17.0 This fixes the same CVE as go1.21.3 and go1.20.10; - net/http: rapid stream resets can cause excessive work A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit. New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 v0.17.0, for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. This is CVE-2023-39325 and Go issue https://go.dev/issue/63417. This is also tracked by CVE-2023-44487. Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 1800dd0) Signed-off-by: Sebastiaan van Stijn <[email protected]>
corhere
approved these changes
Oct 19, 2023
AkihiroSuda
approved these changes
Oct 20, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(partial) backports of;
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)