csaf_opensuse - opensuse-su-2024:13756-1

opensuse-su-2024:13756-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

go1.21-1.21.8-1.1 on GA media

Notes

Title of the patch

go1.21-1.21.8-1.1 on GA media

Description of the patch

These are all security issues fixed in the go1.21-1.21.8-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-13756

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "go1.21-1.21.8-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the go1.21-1.21.8-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-13756",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13756-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45289 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45289/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45290 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45290/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-24783 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-24783/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-24784 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-24784/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-24785 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-24785/"
      }
    ],
    "title": "go1.21-1.21.8-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:13756-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.21-1.21.8-1.1.aarch64",
                "product": {
                  "name": "go1.21-1.21.8-1.1.aarch64",
                  "product_id": "go1.21-1.21.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-doc-1.21.8-1.1.aarch64",
                "product": {
                  "name": "go1.21-doc-1.21.8-1.1.aarch64",
                  "product_id": "go1.21-doc-1.21.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-libstd-1.21.8-1.1.aarch64",
                "product": {
                  "name": "go1.21-libstd-1.21.8-1.1.aarch64",
                  "product_id": "go1.21-libstd-1.21.8-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-race-1.21.8-1.1.aarch64",
                "product": {
                  "name": "go1.21-race-1.21.8-1.1.aarch64",
                  "product_id": "go1.21-race-1.21.8-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.21-1.21.8-1.1.ppc64le",
                "product": {
                  "name": "go1.21-1.21.8-1.1.ppc64le",
                  "product_id": "go1.21-1.21.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-doc-1.21.8-1.1.ppc64le",
                "product": {
                  "name": "go1.21-doc-1.21.8-1.1.ppc64le",
                  "product_id": "go1.21-doc-1.21.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-libstd-1.21.8-1.1.ppc64le",
                "product": {
                  "name": "go1.21-libstd-1.21.8-1.1.ppc64le",
                  "product_id": "go1.21-libstd-1.21.8-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-race-1.21.8-1.1.ppc64le",
                "product": {
                  "name": "go1.21-race-1.21.8-1.1.ppc64le",
                  "product_id": "go1.21-race-1.21.8-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.21-1.21.8-1.1.s390x",
                "product": {
                  "name": "go1.21-1.21.8-1.1.s390x",
                  "product_id": "go1.21-1.21.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-doc-1.21.8-1.1.s390x",
                "product": {
                  "name": "go1.21-doc-1.21.8-1.1.s390x",
                  "product_id": "go1.21-doc-1.21.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-libstd-1.21.8-1.1.s390x",
                "product": {
                  "name": "go1.21-libstd-1.21.8-1.1.s390x",
                  "product_id": "go1.21-libstd-1.21.8-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-race-1.21.8-1.1.s390x",
                "product": {
                  "name": "go1.21-race-1.21.8-1.1.s390x",
                  "product_id": "go1.21-race-1.21.8-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "go1.21-1.21.8-1.1.x86_64",
                "product": {
                  "name": "go1.21-1.21.8-1.1.x86_64",
                  "product_id": "go1.21-1.21.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-doc-1.21.8-1.1.x86_64",
                "product": {
                  "name": "go1.21-doc-1.21.8-1.1.x86_64",
                  "product_id": "go1.21-doc-1.21.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-libstd-1.21.8-1.1.x86_64",
                "product": {
                  "name": "go1.21-libstd-1.21.8-1.1.x86_64",
                  "product_id": "go1.21-libstd-1.21.8-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "go1.21-race-1.21.8-1.1.x86_64",
                "product": {
                  "name": "go1.21-race-1.21.8-1.1.x86_64",
                  "product_id": "go1.21-race-1.21.8-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-1.21.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64"
        },
        "product_reference": "go1.21-1.21.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-1.21.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le"
        },
        "product_reference": "go1.21-1.21.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-1.21.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x"
        },
        "product_reference": "go1.21-1.21.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-1.21.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64"
        },
        "product_reference": "go1.21-1.21.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-doc-1.21.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64"
        },
        "product_reference": "go1.21-doc-1.21.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-doc-1.21.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le"
        },
        "product_reference": "go1.21-doc-1.21.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-doc-1.21.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x"
        },
        "product_reference": "go1.21-doc-1.21.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-doc-1.21.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64"
        },
        "product_reference": "go1.21-doc-1.21.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-libstd-1.21.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64"
        },
        "product_reference": "go1.21-libstd-1.21.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-libstd-1.21.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le"
        },
        "product_reference": "go1.21-libstd-1.21.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-libstd-1.21.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x"
        },
        "product_reference": "go1.21-libstd-1.21.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-libstd-1.21.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64"
        },
        "product_reference": "go1.21-libstd-1.21.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-race-1.21.8-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64"
        },
        "product_reference": "go1.21-race-1.21.8-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-race-1.21.8-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le"
        },
        "product_reference": "go1.21-race-1.21.8-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-race-1.21.8-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x"
        },
        "product_reference": "go1.21-race-1.21.8-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "go1.21-race-1.21.8-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
        },
        "product_reference": "go1.21-race-1.21.8-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45289",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45289"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45289",
          "url": "https://www.suse.com/security/cve/CVE-2023-45289"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221000 for CVE-2023-45289",
          "url": "https://bugzilla.suse.com/1221000"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-45289"
    },
    {
      "cve": "CVE-2023-45290",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45290"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45290",
          "url": "https://www.suse.com/security/cve/CVE-2023-45290"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221001 for CVE-2023-45290",
          "url": "https://bugzilla.suse.com/1221001"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-45290"
    },
    {
      "cve": "CVE-2024-24783",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-24783"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-24783",
          "url": "https://www.suse.com/security/cve/CVE-2024-24783"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1220999 for CVE-2024-24783",
          "url": "https://bugzilla.suse.com/1220999"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-24783"
    },
    {
      "cve": "CVE-2024-24784",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-24784"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-24784",
          "url": "https://www.suse.com/security/cve/CVE-2024-24784"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221002 for CVE-2024-24784",
          "url": "https://bugzilla.suse.com/1221002"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-24784"
    },
    {
      "cve": "CVE-2024-24785",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-24785"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
          "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-24785",
          "url": "https://www.suse.com/security/cve/CVE-2024-24785"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221003 for CVE-2024-24785",
          "url": "https://bugzilla.suse.com/1221003"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-doc-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-libstd-1.21.8-1.1.x86_64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.aarch64",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.ppc64le",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.s390x",
            "openSUSE Tumbleweed:go1.21-race-1.21.8-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-24785"
    }
  ]
}

CVE-2023-45289 (GCVE-0-2023-45289)

Vulnerability from cvelistv5

Published

2024-03-05 22:22

Modified

2025-02-13 17:14

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

Summary

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

References

►

URL

Tags

	https://go.dev/issue/65065
	https://go.dev/cl/569340
	https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
	https://pkg.go.dev/vuln/GO-2024-2600
	https://security.netapp.com/advisory/ntap-20240329-0006/
	http://www.openwall.com/lists/oss-security/2024/03/08/4

Impacted products

Vendor

Product

Version

►

Go standard library

net/http

Version: 0 ≤
Version: 1.22.0-0 ≤

Go standard library

net/http/cookiejar

Version: 0 ≤
Version: 1.22.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45289",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-06T16:34:47.460894Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T18:24:28.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65065"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/569340"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2600"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240329-0006/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "isDomainOrSubdomain"
            },
            {
              "name": "Client.Do"
            },
            {
              "name": "Client.Get"
            },
            {
              "name": "Client.Head"
            },
            {
              "name": "Client.Post"
            },
            {
              "name": "Client.PostForm"
            },
            {
              "name": "Get"
            },
            {
              "name": "Head"
            },
            {
              "name": "Post"
            },
            {
              "name": "PostForm"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http/cookiejar",
          "product": "net/http/cookiejar",
          "programRoutines": [
            {
              "name": "isIP"
            },
            {
              "name": "Jar.Cookies"
            },
            {
              "name": "Jar.SetCookies"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:39.339Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65065"
        },
        {
          "url": "https://go.dev/cl/569340"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2600"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240329-0006/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        }
      ],
      "title": "Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-45289",
    "datePublished": "2024-03-05T22:22:30.306Z",
    "dateReserved": "2023-10-06T17:06:26.221Z",
    "dateUpdated": "2025-02-13T17:14:01.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-24785 (GCVE-0-2024-24785)

Vulnerability from cvelistv5

Published

2024-03-05 22:22

Modified

2025-03-14 00:55

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

Summary

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

References

►

URL

Tags

	https://go.dev/issue/65697
	https://go.dev/cl/564196
	https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
	https://pkg.go.dev/vuln/GO-2024-2610
	https://security.netapp.com/advisory/ntap-20240329-0008/
	http://www.openwall.com/lists/oss-security/2024/03/08/4

Impacted products

	Vendor	Product	Version
	Go standard library	html/template	Version: 0 ≤ Version: 1.22.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24785",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-06T18:49:44.784868Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-14T00:55:26.398Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:28:12.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65697"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/564196"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2610"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240329-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "jsValEscaper"
            },
            {
              "name": "escaper.commit"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "RyotaK (https://ryotak.net)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:37.492Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65697"
        },
        {
          "url": "https://go.dev/cl/564196"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2610"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240329-0008/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        }
      ],
      "title": "Errors returned from JSON marshaling may break template escaping in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24785",
    "datePublished": "2024-03-05T22:22:33.640Z",
    "dateReserved": "2024-01-30T16:05:14.757Z",
    "dateUpdated": "2025-03-14T00:55:26.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-24783 (GCVE-0-2024-24783)

Vulnerability from cvelistv5

Published

2024-03-05 22:22

Modified

2025-02-13 17:40

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-476: NULL Pointer Dereference

Summary

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

References

►

URL

Tags

	https://go.dev/issue/65390
	https://go.dev/cl/569339
	https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
	https://pkg.go.dev/vuln/GO-2024-2598
	https://security.netapp.com/advisory/ntap-20240329-0005/
	http://www.openwall.com/lists/oss-security/2024/03/08/4

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/x509	Version: 0 ≤ Version: 1.22.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-06T18:26:26.163411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T16:57:46.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:28:12.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65390"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/569339"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2598"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240329-0005/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "Certificate.buildChains"
            },
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "John Howard (Google)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:42.854Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65390"
        },
        {
          "url": "https://go.dev/cl/569339"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2598"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240329-0005/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        }
      ],
      "title": "Verify panics on certificates with an unknown public key algorithm in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24783",
    "datePublished": "2024-03-05T22:22:26.647Z",
    "dateReserved": "2024-01-30T16:05:14.757Z",
    "dateUpdated": "2025-02-13T17:40:23.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-24784 (GCVE-0-2024-24784)

Vulnerability from cvelistv5

Published

2024-03-05 22:22

Modified

2025-02-13 17:40

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

Summary

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

References

►

URL

Tags

	https://go.dev/issue/65083
	https://go.dev/cl/555596
	https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
	https://pkg.go.dev/vuln/GO-2024-2609
	https://security.netapp.com/advisory/ntap-20240329-0007/
	http://www.openwall.com/lists/oss-security/2024/03/08/4

Impacted products

	Vendor	Product	Version
	Go standard library	net/mail	Version: 0 ≤ Version: 1.22.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:28:12.523Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65083"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/555596"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2609"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240329-0007/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:go_standard_library:net\\/mail:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "net\\/mail",
            "vendor": "go_standard_library",
            "versions": [
              {
                "lessThan": "1.21.8",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "1.22.1",
                "status": "affected",
                "version": "1.22.0-0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24784",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-05T20:13:24.512123Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:17:30.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/mail",
          "product": "net/mail",
          "programRoutines": [
            {
              "name": "addrParser.consumeGroupList"
            },
            {
              "name": "addrParser.consumePhrase"
            },
            {
              "name": "isAtext"
            },
            {
              "name": "Address.String"
            },
            {
              "name": "AddressParser.Parse"
            },
            {
              "name": "AddressParser.ParseList"
            },
            {
              "name": "Header.AddressList"
            },
            {
              "name": "ParseAddress"
            },
            {
              "name": "ParseAddressList"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Nurminen of Mattermost"
        },
        {
          "lang": "en",
          "value": "Slonser (https://github.com/Slonser)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:41.105Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65083"
        },
        {
          "url": "https://go.dev/cl/555596"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2609"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240329-0007/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        }
      ],
      "title": "Comments in display names are incorrectly handled in net/mail"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24784",
    "datePublished": "2024-03-05T22:22:32.186Z",
    "dateReserved": "2024-01-30T16:05:14.757Z",
    "dateUpdated": "2025-02-13T17:40:24.430Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45290 (GCVE-0-2023-45290)

Vulnerability from cvelistv5

Published

2024-03-05 22:22

Modified

2025-02-13 17:14

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400: Uncontrolled Resource Consumption

Summary

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

References

►

URL

Tags

	https://go.dev/issue/65383
	https://go.dev/cl/569341
	https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
	https://pkg.go.dev/vuln/GO-2024-2599
	https://security.netapp.com/advisory/ntap-20240329-0004/
	http://www.openwall.com/lists/oss-security/2024/03/08/4

Impacted products

	Vendor	Product	Version
	Go standard library	net/textproto	Version: 0 ≤ Version: 1.22.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-06T15:04:15.773941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T11:07:13.798Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.331Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65383"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/569341"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2599"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240329-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/textproto",
          "product": "net/textproto",
          "programRoutines": [
            {
              "name": "Reader.readLineSlice"
            },
            {
              "name": "Reader.readContinuedLineSlice"
            },
            {
              "name": "Reader.ReadCodeLine"
            },
            {
              "name": "Reader.ReadContinuedLine"
            },
            {
              "name": "Reader.ReadContinuedLineBytes"
            },
            {
              "name": "Reader.ReadDotLines"
            },
            {
              "name": "Reader.ReadLine"
            },
            {
              "name": "Reader.ReadLineBytes"
            },
            {
              "name": "Reader.ReadMIMEHeader"
            },
            {
              "name": "Reader.ReadResponse"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bartek Nowotarski"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:46.260Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65383"
        },
        {
          "url": "https://go.dev/cl/569341"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2599"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240329-0004/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        }
      ],
      "title": "Memory exhaustion in multipart form parsing in net/textproto and net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-45290",
    "datePublished": "2024-03-05T22:22:28.703Z",
    "dateReserved": "2023-10-06T17:06:26.221Z",
    "dateUpdated": "2025-02-13T17:14:02.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

opensuse-su-2024:13756-1

Vulnerability from csaf_opensuse

CVE-2023-45289 (GCVE-0-2023-45289)

Vulnerability from cvelistv5

CVE-2024-24785 (GCVE-0-2024-24785)

Vulnerability from cvelistv5

CVE-2024-24783 (GCVE-0-2024-24783)

Vulnerability from cvelistv5

CVE-2024-24784 (GCVE-0-2024-24784)

Vulnerability from cvelistv5

CVE-2023-45290 (GCVE-0-2023-45290)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature