starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-09-28 02:06:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

vendor: golang.org/x/net v0.23.0

Browse Source 
full diff: https://github.com/golang/net/compare/v0.22.0...v0.23.0

Includes a fix for CVE-2023-45288, which is also addressed in go1.22.2
and go1.21.9;

> http2: close connections when receiving too many headers
>
> Maintaining HPACK state requires that we parse and process
> all HEADERS and CONTINUATION frames on a connection.
> When a request's headers exceed MaxHeaderBytes, we don't
> allocate memory to store the excess headers but we do
> parse them. This permits an attacker to cause an HTTP/2
> endpoint to read arbitrary amounts of data, all associated
> with a request which is going to be rejected.
>
> Set a limit on the amount of excess header frames we
> will process before closing a connection.
>
> Thanks to Bartek Nowotarski for reporting this issue.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 5fcbbde4b9)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn
2024-04-10 09:41:15 +02:00
parent 156e20ca86
commit c33cc928bb
8 changed files with 620 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor/modules.txt
Vendored
+1 -1
View File
@@ -315,7 +315,7 @@ golang.org/x/crypto/pbkdf2
# golang.org/x/mod v0.14.0
## explicit; go 1.18
golang.org/x/mod/semver
# golang.org/x/net v0.22.0
# golang.org/x/net v0.23.0
## explicit; go 1.18
golang.org/x/net/http/httpguts
golang.org/x/net/http2