Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in golang.org/x/net: CVE-2024-45338 #3333

Closed
tatianab opened this issue Dec 13, 2024 · 3 comments
Closed

x/vulndb: potential Go vuln in golang.org/x/net: CVE-2024-45338 #3333

tatianab opened this issue Dec 13, 2024 · 3 comments
Assignees
@tatianab
Labels
first party high priority triaged

Comments

@tatianab
Copy link
Contributor

tatianab commented Dec 13, 2024 •
edited
Loading

Hello gophers,

We have tagged version v0.33.0 of golang.org/x/net in order to address a security issue.

x/net/html: non-linear parsing of case-insensitive content

Version v0.33.0 of golang.org/x/net fixes a vulnerability in the golang.org/x/net/html package which could cause a denial of service.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

Thanks to Guido Vranken for reporting this issue.

This is CVE-2024-45338 and Go issue https://go.dev/issue/70906.

Cheers,
Go Security team

https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
@tatianab tatianab self-assigned this Dec 13, 2024
@tatianab tatianab changed the title x/vulndb: potential Go vuln in <placeholder>: CVE-2024-45338 x/vulndb: potential Go vuln in golang.org/x/net: CVE-2024-45338 Dec 13, 2024
@xnox
Copy link

xnox commented Dec 18, 2024

Public

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/637537 mentions this issue: data/reports: add GO-2024-3333

gopherbot pushed a commit that referenced this issue Dec 18, 2024
@tatianab @gopherbot
data/reports: add GO-2024-3333
230cf22 
  - data/reports/GO-2024-3333.yaml

Updates #3333

Change-Id: Id9b61dd02b98b6afe8061b66207f9c4d7680ef39
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/637537
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
@tatianab tatianab mentioned this issue Dec 20, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/637959 mentions this issue: data/reports: add GHSA for GO-2024-3333

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
first party high priority triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@xnox @tatianab @gopherbot