sync/ports
1
0
Fork 0
mirror of https://git.freebsd.org/ports.git synced 2025-07-17 17:29:23 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

security/vuxml: Document Go vulnerability

Browse source 
Security:	CVE-2024-24791
This commit is contained in:
Ashish SHUKLA 2024-07-03 08:07:06 +00:00
parent c54976312d
commit a2efe54fd6
No known key found for this signature in database
1 changed files with 43 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
security/vuxml/vuln/2024.xml
View file

@ -1,3 +1,46 @@
<vuln vid="b0374722-3912-11ef-a77e-901b0e9408dc">
<topic>go -- net/http: denial of service due to improper 100-continue handling</topic>
<affects>
<package>
<name>go122</name>
<range><lt>1.22.5</lt></range>
</package>
<package>
<name>go121</name>
<range><lt>1.21.12</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>The Go project reports:</p>
<blockquote cite="https://go.dev/issue/67555">
<p>net/http: denial of service due to improper 100-continue handling</p>
<p>The net/http HTTP/1.1 client mishandled the case where a
server responds to a request with an "Expect: 100-continue"
header with a non-informational (200 or higher) status. This
mishandling could leave a client connection in an invalid
state, where the next request sent on the connection will
fail.</p>
<p>An attacker sending a request to a
net/http/httputil.ReverseProxy proxy can exploit this
mishandling to cause a denial of service by sending "Expect:
100-continue" requests which elicit a non-informational
response from the backend. Each such request leaves the
proxy with an invalid connection, and causes one subsequent
request using that connection to fail.</p>
</blockquote>
</body>
</description>
<references>
<cvename>CVE-2024-24791</cvename>
<url>https://go.dev/issue/67555</url>
</references>
<dates>
<discovery>2024-07-02</discovery>
<entry>2024-07-03</entry>
</dates>
</vuln>
<vuln vid="d7efc2ad-37af-11ef-b611-84a93843eb75">
<topic>Apache httpd -- Multiple vulnerabilities</topic>
<affects>