When parsing a multipart form (either explicitly with
Request.ParseMultipartForm or implicitly with Request.FormValue,
Request.PostFormValue, or Request.FormFile), limits on the total size of
the parsed form were not applied to the memory consumed while reading a
single form line. This permits a maliciously crafted input containing very
long lines to cause allocation of arbitrarily large amounts of memory,
potentially leading to memory exhaustion. With fix, the ParseMultipartForm
function now correctly limits the maximum size of form lines.
Author | Note |
---|---|
mdeslaur | Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays. Warning: do not include nullboot in the list of no-change rebuilds after fixing an issue in golang. |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 14.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 16.04 | noarch | golang-1.10 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 22.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 16.04 | noarch | golang-1.13 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.14 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | golang-1.16 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | golang-1.16 | < any | UNKNOWN |
github.com/golang/go/commit/041a47712e765e94f86d841c3110c840e76d8f82 (go1.22.1)
github.com/golang/go/commit/bf80213b121074f4ad9b449410a4d13bae5e9be0 (go1.21.8)
github.com/golang/go/issues/65383
go.dev/cl/569341
go.dev/issue/65383
groups.google.com/g/golang-announce/c/5pwGVUPoMbg
launchpad.net/bugs/cve/CVE-2023-45290
nvd.nist.gov/vuln/detail/CVE-2023-45290
pkg.go.dev/vuln/GO-2024-2599
security-tracker.debian.org/tracker/CVE-2023-45290
www.cve.org/CVERecord?id=CVE-2023-45290