Repository navigation
net/http: handle server errors after sending GOAWAY #54658
Description
A closing HTTP/2 server connection could hang forever waiting for a clean shutdown that was preempted by a subsequent fatal error. This failure mode could be exploited to cause a denial of service.
Thanks to Bahruz Jabiyev, Tommaso Innocenti, Anthony Gavazzi, Steven Sprecher, and Kaan Onarlioglu for reporting this.
This was a PRIVATE issue for CVE-2022-27664 tracked in http://b/219507101.
Backport issues: #53977 #54376
(I forgot to create the non-backport issue when making the backports, doing so now.)
Activity
gopherbot commentedon Sep 6, 2022
Change https://go.dev/cl/428655 mentions this issue:
[release-branch.go1.19] net/http: update bundled golang.org/x/net/http2gopherbot commentedon Sep 6, 2022
Change https://go.dev/cl/428635 mentions this issue:
[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2[release-branch.go1.19] net/http: update bundled golang.org/x/net/http2
[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2
[-]security: fix CVE-2022-27664[/-][+]net/http: handle server errors after sending GOAWAY[/+]gopherbot commentedon Sep 6, 2022
Change https://go.dev/cl/428736 mentions this issue:
[internal-branch.go1.18-vendor] http2: handle server errors after sending GOAWAYgopherbot commentedon Sep 6, 2022
Change https://go.dev/cl/428737 mentions this issue:
[internal-branch.go1.19-vendor] http2: handle server errors after sending GOAWAYgopherbot commentedon Sep 6, 2022
Change https://go.dev/cl/428717 mentions this issue:
all: update vendored golang.org/x/net[internal-branch.go1.19-vendor] http2: handle server errors after sen…
[internal-branch.go1.18-vendor] http2: handle server errors after sen…
2 remaining items
tangxi666 commentedon Sep 9, 2022
@neild
[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2
[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2
[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2
[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2
gkurz commentedon Sep 15, 2022
@neild does this affect older versions of go like 1.16 or 1.17 ?
net/http: update bundled golang.org/x/net/http2
net/http: update bundled golang.org/x/net/http2
net/http: update bundled golang.org/x/net/http2
gkurz commentedon Nov 2, 2022
Assuming that the thumbs up added by other people mean yes, is there a backport for 1.17 of this fix ? @neild any inputs ?
seankhliao commentedon Nov 2, 2022
No https://go.dev/doc/devel/release#policy
all: update vendored golang.org/x/net