Bug 2107374 (CVE-2022-1705)
| Summary: | CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Anten Skrabec <askrabec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abishop, acui, adam.kaplan, adudiak, agarcial, agerstmayr, akashem, akostadi, akoutsou, alcohan, alexander.bulimov, amackenz, amasferr, amctagga, amurdaca, andrew.jeddeloh, anjoseph, anon.amish, anpicker, ansmith, aoconnor, aos-network-edge-staff, aos-odin-bot, aos-team-ota, aputtur, asm, athoscribeiro, aveerama, bbaude, bbennett, bcl, bcoca, bdettelb, bgilbert, bkundu, bmontgom, bniver, bodavis, bperkins, brking, bthurber, carl, carmelo.sarta.main, cbartlet, cdaley, chazlett, chousekn, cmarinea, cmeyers, container-sig, crizzo, dagray, davide, davidn, dbenoit, debarshir, denis, deparker, dfreiber, dhanak, dmayorov, doconnor, dornelas, dperaza, drow, dsimansk, dustymabe, dwalsh, dwd, dwest, dwhatley, dymurray, eduardo.ramalho, eglynn, emachado, eparis, ericedens, esm, extras-orphan, fdeutsch, filbranden, fjansen, flucifre, fpokorny, gblomqui, gchamoul, gmeno, gparvin, grafana-maint, haoli, hhorak, hkataria, ibolton, i, ijolliff, inoton, jacding, jaharrin, jajackso, jbrooks, jburrell, jcajka, jcammara, jcantril, jchaloup, jchui, jeder, jerzhang, jhadvig, jhardy, jhrozek, jitsingh, jjoyce, jligon, jlledo, jmatthew, jmencak, jmitchel, jmontleo, jneedle, jnovy, jobarker, joelsmith, jonathan, jorton, jpadman, jprabhak, jramanat, jschluet, jwboyer, jwendell, jwon, kegrant, kingland, koliveir, kshier, ktokunaga.mail, kverlaen, kwalker, lball, lbragsta, lchilton, lemenkov, lhh, link, lkiesow, lmadsen, lmeyer, lsm5, lsvaty, mabashia, manissin, marcandre.lureau, mark.e.fuller, matzew, maxwell, mbenjamin, mburns, mcressma, me, mfojtik, mgarciac, mgoodwin, mhackett, mheon, miabbott, michel, mkudlej, mmakovy, mnewsome, mnovotny, mrunge, mrussell, mskalicky, mwringe, nathans, njean, nobody, notting, nparekh, nstielau, ntait, n.yaghoobi.s, obudai, obulatov, ocp-storage-bot, ocs-bugs, o.lemasle, omaciel, openshift-release-oversight, opohorel, oramraz, osapryki, osbuilders, oskutka, owatkins, pahickey, pakotvan, patrick, paul, paul.wouters, pbraun, pegoncal, peholase, pehunt, periklis, pgaikwad, pgrist, philipp, pjindal, pknezevi, pkubat, ploffay, pthomas, quantum.analyst, rakesh.pandit, rcernich, redhat, relrod, rhaigner, rhcos-sst, rhcos-triage, rhos-maint, rhuss, rjohnson, rojacob, rominf, rpetrell, rphillips, sanchezl, saroy, sausingh, scorneli, sdoran, sejug, sfeifer, sgott, shvarugh, simaishi, sipoyare, skontopo, skunkerk, slaznick, slucidi, smcdonal, smullick, sostapov, spandura, spasquie, sponnaga, spower, spresti, sseago, ssteinbe, stcannon, stirabos, surbania, teagle, team-winc-bot, tfister, tgunders, thason, thavo, thrcka, tjochec, tkuratom, travier, tsedovic, tstellar, tsweeney, twalsh, uhhadd, umohnani, user-cont-team+packit-fas, vereddy, vimartin, vkumar, walters, wenshen, whayutin, wtam, xiyuan, xxia, yanqiyu01, yguenane, yselkowi, ytale, zdohnal |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | golang 1.18.4, golang 1.17.12 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-16 23:47:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2107375, 2109914, 2109915, 2109916, 2109917, 2110276, 2110278, 2111001, 2111496, 2111746, 2111747, 2111752, 2111753, 2111758, 2111759, 2111760, 2111765, 2111766, 2111767, 2111772, 2111773, 2111774, 2111775, 2111782, 2111783, 2111786, 2111796, 2111797, 2111798, 2111805, 2111806, 2111807, 2111808, 2111816, 2111821, 2111822, 2111823, 2111826, 2111827, 2111828, 2111829, 2111830, 2111831, 2111833, 2112009, 2112010, 2118642, 2118643, 2118644, 2118645, 2118646, 2118647, 2118648, 2118649, 2119857, 2119858, 2119859, 2119860, 2119861, 2120619, 2120620, 2123509, 2123510, 2123514, 2123748, 2123750, 2123754, 2134423, 2134424, 2168805 | ||
| Bug Blocks: | 2108714 | ||
|
Description
Anten Skrabec
2022-07-14 20:34:07 UTC
Created golang tracking bugs for this issue: Affects: fedora-all [bug 2107375] Created golang tracking bugs for this issue: Affects: epel-all [bug 2110278] This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:5775 https://access.redhat.com/errata/RHSA-2022:5775 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:5799 https://access.redhat.com/errata/RHSA-2022:5799 This issue has been addressed in the following products: Red Hat Developer Tools Via RHSA-2022:5866 https://access.redhat.com/errata/RHSA-2022:5866 This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2022:6042 https://access.redhat.com/errata/RHSA-2022:6042 This issue has been addressed in the following products: Openshift Serveless 1.24 Via RHSA-2022:6040 https://access.redhat.com/errata/RHSA-2022:6040 This issue has been addressed in the following products: Application Interconnect 1 for RHEL 8 Via RHSA-2022:6113 https://access.redhat.com/errata/RHSA-2022:6113 This issue has been addressed in the following products: Node Healthcheck Operator 0.3 for RHEL 8 Via RHSA-2022:6187 https://access.redhat.com/errata/RHSA-2022:6187 This issue has been addressed in the following products: Node Maintenance Operator 4.11 for RHEL 8 Via RHSA-2022:6188 https://access.redhat.com/errata/RHSA-2022:6188 This issue has been addressed in the following products: OSSO-1.1-RHEL-8 Via RHSA-2022:6152 https://access.redhat.com/errata/RHSA-2022:6152 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 Via RHSA-2022:6347 https://access.redhat.com/errata/RHSA-2022:6347 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 Via RHSA-2022:6346 https://access.redhat.com/errata/RHSA-2022:6346 This issue has been addressed in the following products: Logging subsystem for Red Hat OpenShift 5.4 Via RHSA-2022:6183 https://access.redhat.com/errata/RHSA-2022:6183 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 Via RHSA-2022:6348 https://access.redhat.com/errata/RHSA-2022:6348 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.1 for RHEL 8 Via RHSA-2022:6345 https://access.redhat.com/errata/RHSA-2022:6345 This issue has been addressed in the following products: RHOL-5.5-RHEL-8 Via RHSA-2022:6344 https://access.redhat.com/errata/RHSA-2022:6344 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 Via RHSA-2022:6370 https://access.redhat.com/errata/RHSA-2022:6370 This issue has been addressed in the following products: OADP-1.0-RHEL-8 Via RHSA-2022:6430 https://access.redhat.com/errata/RHSA-2022:6430 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7129 https://access.redhat.com/errata/RHSA-2022:7129 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7519 https://access.redhat.com/errata/RHSA-2022:7519 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7529 https://access.redhat.com/errata/RHSA-2022:7529 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7648 https://access.redhat.com/errata/RHSA-2022:7648 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8057 https://access.redhat.com/errata/RHSA-2022:8057 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8098 https://access.redhat.com/errata/RHSA-2022:8098 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:8250 https://access.redhat.com/errata/RHSA-2022:8250 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.11 Ironic content for Red Hat OpenShift Container Platform 4.11 Via RHSA-2022:8626 https://access.redhat.com/errata/RHSA-2022:8626 This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.7 Via RHSA-2022:9047 https://access.redhat.com/errata/RHSA-2022:9047 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2022:7399 https://access.redhat.com/errata/RHSA-2022:7399 This issue has been addressed in the following products: RHEL-8-CNV-4.12 RHEL-7-CNV-4.12 Via RHSA-2023:0407 https://access.redhat.com/errata/RHSA-2023:0407 This issue has been addressed in the following products: RHEL-8-CNV-4.12 Via RHSA-2023:0408 https://access.redhat.com/errata/RHSA-2023:0408 This issue has been addressed in the following products: OpenShift Custom Metrics Autoscaler 2 Via RHSA-2023:1042 https://access.redhat.com/errata/RHSA-2023:1042 This issue has been addressed in the following products: Red Hat OpenStack Platform 16.1 Red Hat OpenStack Platform 16.2 Via RHSA-2023:1275 https://access.redhat.com/errata/RHSA-2023:1275 This issue has been addressed in the following products: STF-1.5-RHEL-8 Via RHSA-2023:1529 https://access.redhat.com/errata/RHSA-2023:1529 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:2357 https://access.redhat.com/errata/RHSA-2023:2357 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.11.0 Via https://access.redhat.com/errata/RHSA-2022:5068 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2758 https://access.redhat.com/errata/RHSA-2023:2758 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2802 https://access.redhat.com/errata/RHSA-2023:2802 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-1705 This issue has been addressed in the following products: Red Hat Ceph Storage 6.1 Via RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642 This issue has been addressed in the following products: OpenShift Developer Tools and Services for OCP 4.11 Via RHSA-2023:3664 https://access.redhat.com/errata/RHSA-2023:3664 |