中危 通过 net/http 中的块扩展拒绝服务 (CVE-2023-39326)

CVE编号

CVE-2023-39326

利用情况

暂无

补丁情况

官方补丁

披露时间

2023-12-07

漏洞描述

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://go.dev/cl/547335
https://go.dev/issue/64433
https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
https://pkg.go.dev/vuln/GO-2023-2382

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	golang	go	*		Up to (excluding) 1.20.12
	运行在以下环境
	应用	golang	go	*	From (including) 1.21.0-0	Up to (excluding) 1.21.5
	运行在以下环境
	系统	alpine_3.19	go	*		Up to (excluding) 1.21.5-r0
	运行在以下环境
	系统	alpine_edge	go	*		Up to (excluding) 1.21.5-r0
	运行在以下环境
	系统	debian_10	golang-1.11	*		Up to (including) 1.11.6-1+deb10u4
	运行在以下环境
	系统	debian_11	golang-1.15	*		Up to (including) 1.15.15-1~deb11u4
	运行在以下环境
	系统	debian_12	golang-1.19	*		Up to (including) 1.19.8-2
	运行在以下环境
	系统	debian_sid	golang-1.20	*		Up to (excluding) 1.20.12-1

阿里云评分 4.8

• 攻击路径 本地
• 攻击复杂度 困难
• 权限要求 管控权限
• 影响范围 有限影响
• EXP成熟度 未验证
• 补丁情况 官方补丁
• 数据保密性 无影响
• 数据完整性 无影响
• 服务器危害 无影响
• 全网数量 N/A

CWE-ID	漏洞类型
NVD-CWE-noinfo

Exp相关链接

- avd.aliyun.com