USN-8900-1: Go Networking vulnerabilities
Ubuntu patches Go networking flaws that can hang HTTP/2 connections or exhaust resources via HPACK.
Ubuntu Security Notice USN-8900-1 covers flaws in Go networking. CVE-2022-27664 can leave an HTTP/2 connection hanging after a GOAWAY frame during shutdown, and CVE-2022-41723 gives HPACK header decoding quadratic complexity, both allowing remote denial of service. A further issue can render text nodes outside the HTML namespace without required escaping. The notice does not report observed exploitation.
- CVE-2022-27664 can hang HTTP/2 connections after a GOAWAY frame.
- CVE-2022-41723 makes HPACK decoding costly and can exhaust resources.
- A separate bug can leave text outside the HTML namespace unescaped.
- The notice does not report that exploitation is underway.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-27664 | In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if… | 7.5 | 3% | ||
| CVE-2022-41723 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of… | 7.5 | 5% |
From the original article
It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-27664) It was discovered that Go Networking had quadratic complexity when decoding HPACK headers in HTTP/2 streams.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.