PT-2023-14021 · Google+1 · Golang.Org/X/Net/Http2/H2C+1

John Howard · Publicado 2023-01-13 · Atualizado 2025-04-04 · CVE-2022-41721

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions golang.org/x/net/http2/h2c (affected versions not specified)

Description A request smuggling attack is possible when using MaxBytesHandler. The body of an HTTP request is not fully consumed, and when the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request. This could be attacker-manipulated to represent arbitrary HTTP2 requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

AZL-13029

CVE-2022-41721

ECHO-FC94-9D86-65B0

GHSA-FXG5-WQ6X-VR4W

GO-2023-1495

OPENSUSE-SU-2024:12666-1

Produtos afetados

Astra Linux

Golang.Org/X/Net/Http2/H2C

Referências · 17

• 🔥 https://go.dev/issue/56352 · Exploit
• https://osv.dev/vulnerability/GO-2023-1495 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-13029 · Aviso do Fabricante
• https://t.me/cvenotify/117767 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-fxg5-wq6x-vr4w · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X3H3EWQXM2XL5AGBX6UL443JEJ3GQXJN · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-41721 · Nota de Segurança
• https://pkg.go.dev/vuln/GO-2023-1495 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:12666-1 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X5DXTLLWN6HKI5I35EUZRBISTNZJ75GP · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2022-41721 · Aviso do Fabricante
• https://go.dev/cl/447396 · Aviso do Fabricante
• https://cs.opensource.google/go/x/net · Nota
• https://suse.com/security/cve/CVE-2022-41721 · Nota
• https://osv.dev/vulnerability/CVE-2022-41721 · Aviso do Fabricante