Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[24.0 backport] vendor: golang.org/x/net v0.17.0 #4609

Merged
merged 8 commits into from
Oct 19, 2023
Merged

[24.0 backport] vendor: golang.org/x/net v0.17.0 #4609

merged 8 commits into from
Oct 19, 2023

Commits on Oct 19, 2023

  1. vendor: golang.org/x/sync v0.3.0 

    full diff: golang/sync@v0.1.0...v0.3.0

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 1554b49)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    54894f0 View commit details
    Browse the repository at this point in the history

  2. vendor: golang.org/x/sys v0.10.0 

    full diff: golang/sys@v0.8.0...v0.10.0

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit ffea694)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    aef1157 View commit details
    Browse the repository at this point in the history

  3. vendor: golang.org/x/crypto v0.9.0 

    full diff: golang/crypto@v0.3.0...v0.9.0

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit c9d56b8)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    8c4dc6c View commit details
    Browse the repository at this point in the history

  4. vendor: golang.org/x/sys v0.13.0 

    full diff: golang/sys@v0.10.0...v0.13.0

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 48655f7)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    0d554b5 View commit details
    Browse the repository at this point in the history

  5. vendor: golang.org/x/text v0.13.0 

    full diff: golang/text@v0.9.0...v0.13.0

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit ac30778)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    66558a4 View commit details
    Browse the repository at this point in the history

  6. vendor: golang.org/x/term v0.13.0 

    - term: consistently return zeroes on GetSize error

full diff: golang/term@v0.8.0...v0.13.0

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 392db31)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    6c5bc49 View commit details
    Browse the repository at this point in the history

  7. vendor: golang.org/x/crypto v0.14.0 

    full diff: golang/crypto@v0.9.0...v0.14.0

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 612a171)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    1919679 View commit details
    Browse the repository at this point in the history

  8. vendor: golang.org/x/net v0.17.0 

    full diff: golang/net@v0.10.0...v0.17.0

This fixes the same CVE as go1.21.3 and go1.20.10;

- net/http: rapid stream resets can cause excessive work

  A malicious HTTP/2 client which rapidly creates requests and
  immediately resets them can cause excessive server resource consumption.
  While the total number of requests is bounded to the
  http2.Server.MaxConcurrentStreams setting, resetting an in-progress
  request allows the attacker to create a new request while the existing
  one is still executing.

  HTTP/2 servers now bound the number of simultaneously executing
  handler goroutines to the stream concurrency limit. New requests
  arriving when at the limit (which can only happen after the client
  has reset an existing, in-flight request) will be queued until a
  handler exits. If the request queue grows too large, the server
  will terminate the connection.

  This issue is also fixed in golang.org/x/net/http2 v0.17.0,
  for users manually configuring HTTP/2.

  The default stream concurrency limit is 250 streams (requests)
  per HTTP/2 connection. This value may be adjusted using the
  golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
  setting and the ConfigureServer function.

  This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
  This is also tracked by CVE-2023-44487.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit a27466f)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Oct 19, 2023
    Configuration menu
    Copy the full SHA
    d43c48d View commit details
    Browse the repository at this point in the history