PT-2017-10803 · Go+3 · Net/Http Package+3

Michael Fraenkel · Published 2017-04-08 · Updated 2022-08-16 · CVE-2017-1000098

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions net/http package (affected versions not specified)

Description The issue arises when the net/http package's Request.ParseMultipartForm method handles large multipart requests, potentially leading to a denial-of-service situation. An attacker can craft a multipart request that causes the server to run out of file descriptors, as the method starts writing to temporary files once the request body size exceeds the given "maxMemory" limit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-769

Related Identifiers

ALT-PU-2017-1440

AZL-79016

CESA-2017_1859

CVE-2017-1000098

DLA-1123-1

GO-2021-0172

RHSA-2017:1859

RHSA-2017_1859

Affected Products

Alt Linux

Centos

Red Hat

Net/Http Package

References · 15

• https://osv.dev/vulnerability/CVE-2017-1000098 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-79016 · Vendor Advisory
• https://golang.org/issue/17965 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000098 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-1000098 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000098 · Vendor Advisory
• https://golang.org/cl/30410 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0172 · Vendor Advisory
• https://go.dev/issue/16296 · Note
• https://groups.google.com/forum/#%21msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ · Note
• https://groups.google.com/forum/#!msg/golang-dev/4NdLzS8sls8/uIz8QlnIBQAJ · Note
• https://go.googlesource.com/go/+/7478ea5dba7ed02ddffd91c1d17ec8141f7cf184 · Note
• https://go.dev/cl/30410 · Note
• https://groups.google.com/g/golang-dev/c/4NdLzS8sls8/m/uIz8QlnIBQAJ · Note