CVE-2022-27664

2022-09-0618:15:12

Debian Security Bug Tracker

security-tracker.debian.org

go language

net/http

denial of service

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

62.1%

JSON

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

OSVersionArchitecturePackageVersionFilename
Debian11allgolang-1.15<= 1.15.15-1~deb11u4golang-1.15_1.15.15-1~deb11u4_all.deb
Debian12allgolang-1.19< 1.19.1-1golang-1.19_1.19.1-1_all.deb
Debian12allgolang-golang-x-net< 1:0.0+git20221012.0b7e1fb+dfsg-1golang-golang-x-net_1:0.0+git20221012.0b7e1fb+dfsg-1_all.deb
Debian11allgolang-golang-x-net<= 1:0.0+git20210119.5f4716e+dfsg-4golang-golang-x-net_1:0.0+git20210119.5f4716e+dfsg-4_all.deb
Debian999allgolang-golang-x-net< 1:0.0+git20221012.0b7e1fb+dfsg-1golang-golang-x-net_1:0.0+git20221012.0b7e1fb+dfsg-1_all.deb
Debian13allgolang-golang-x-net< 1:0.0+git20221012.0b7e1fb+dfsg-1golang-golang-x-net_1:0.0+git20221012.0b7e1fb+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	golang-1.15	<= 1.15.15-1~deb11u4	golang-1.15_1.15.15-1~deb11u4_all.deb
Debian	12	all	golang-1.19	< 1.19.1-1	golang-1.19_1.19.1-1_all.deb
Debian	12	all	golang-golang-x-net	< 1:0.0+git20221012.0b7e1fb+dfsg-1	golang-golang-x-net_1:0.0+git20221012.0b7e1fb+dfsg-1_all.deb
Debian	11	all	golang-golang-x-net	<= 1:0.0+git20210119.5f4716e+dfsg-4	golang-golang-x-net_1:0.0+git20210119.5f4716e+dfsg-4_all.deb
Debian	999	all	golang-golang-x-net	< 1:0.0+git20221012.0b7e1fb+dfsg-1	golang-golang-x-net_1:0.0+git20221012.0b7e1fb+dfsg-1_all.deb
Debian	13	all	golang-golang-x-net	< 1:0.0+git20221012.0b7e1fb+dfsg-1	golang-golang-x-net_1:0.0+git20221012.0b7e1fb+dfsg-1_all.deb