PT-2017-10803 · Go+3 · Net/Http Package+3

Michael Fraenkel · Publicado 2017-04-08 · Atualizado 2022-08-16 · CVE-2017-1000098

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions net/http package (affected versions not specified)

Description The issue arises when the net/http package's Request.ParseMultipartForm method handles large multipart requests, potentially leading to a denial-of-service situation. An attacker can craft a multipart request that causes the server to run out of file descriptors, as the method starts writing to temporary files once the request body size exceeds the given "maxMemory" limit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-769

Identificadores relacionados

ALT-PU-2017-1440

AZL-79016

CESA-2017_1859

CVE-2017-1000098

DLA-1123-1

GO-2021-0172

RHSA-2017:1859

RHSA-2017_1859

Produtos afetados

Alt Linux

Centos

Red Hat

Net/Http Package

Referências · 15

• https://go.dev/issue/16296 · Nota
• https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ · Nota
• https://osv.dev/vulnerability/CVE-2017-1000098 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-79016 · Aviso do Fabricante
• https://golang.org/issue/17965 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-1000098 · Aviso do Fabricante
• https://groups.google.com/forum/#!msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000098 · Nota de Segurança
• https://go.googlesource.com/go/+/7478ea5dba7ed02ddffd91c1d17ec8141f7cf184 · Nota
• https://cve.org/CVERecord?id=CVE-2017-1000098 · Nota de Segurança
• https://go.dev/cl/30410 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000098 · Aviso do Fabricante
• https://groups.google.com/g/golang-dev/c/4NdLzS8sls8/m/uIz8QlnIBQAJ · Nota
• https://golang.org/cl/30410 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2021-0172 · Aviso do Fabricante