Lucene search

K
freebsdFreeBSDB0374722-3912-11EF-A77E-901B0E9408DC
HistoryJul 02, 2024 - 12:00 a.m.

go -- net/http: denial of service due to improper 100-continue handling

2024-07-0200:00:00
vuxml.freebsd.org
23
denial of service
100-continue handling
net/http
reverseproxy
unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

The Go project reports:

net/http: denial of service due to improper 100-continue handling
The net/http HTTP/1.1 client mishandled the case where a
server responds to a request with an “Expect: 100-continue”
header with a non-informational (200 or higher) status. This
mishandling could leave a client connection in an invalid
state, where the next request sent on the connection will
fail.
An attacker sending a request to a
net/http/httputil.ReverseProxy proxy can exploit this
mishandling to cause a denial of service by sending “Expect:
100-continue” requests which elicit a non-informational
response from the backend. Each such request leaves the
proxy with an invalid connection, and causes one subsequent
request using that connection to fail.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchgo122< 1.22.5UNKNOWN
FreeBSDanynoarchgo121< 1.21.12UNKNOWN

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

Related for B0374722-3912-11EF-A77E-901B0E9408DC