Bug 2279814 (CVE-2024-24788)
| Summary: | CVE-2024-24788 golang: net: malformed DNS message can cause infinite loop | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Avinash Hanwate <ahanwate> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, abishop, adudiak, akostadi, amasferr, amctagga, anjoseph, ansmith, aoconnor, apevec, apjagtap, asatyam, aveerama, bdettelb, bniver, bodavis, caswilli, cbartlet, cdaley, chazlett, davidn, dbenoit, dfreiber, dhanak, diagrawa, dkenigsb, dmayorov, dperaza, drow, dsimansk, dymurray, eaguilar, ebaron, eglynn, emachado, epacific, fdeutsch, fjansen, flucifre, ganandan, gkamathe, gmeno, gparvin, gsuckevi, ibolton, jburrell, jcammara, jcantril, jchui, jhardy, jjoyce, jkang, jkoehler, jlledo, jmatthew, jmoller, jmontleo, jneedle, jobarker, joelsmith, jpallich, jprabhak, jschluet, kaycoth, kholdawa, kingland, kshier, ktsao, kverlaen, lbainbri, lhh, lmadsen, lsvaty, mabashia, matzew, mbenjamin, mbocek, mburns, mgarciac, mhackett, mjaros, mkudlej, mmagr, mmakovy, mnewsome, mnovotny, mrajanna, mrunge, mwringe, nboldt, njean, nobody, odf-bz-bot, omaciel, orabin, oramraz, osapryki, owatkins, pahickey, peholase, periklis, pgrist, pierdipi, pjindal, psegedy, rguimara, rhaigner, rhos-maint, rhuss, rjohnson, rtaniwa, sabiswas, sakbas, saroy, sdawley, sfroberg, sidakwo, simaishi, sipoyare, skontopo, slucidi, smcdonal, smullick, sostapov, spandura, sseago, stcannon, teagle, tjochec, tkral, ubhargav, vereddy, vkumar, whayutin, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Go 1.22.3, Go 1.21.10 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service (DoS) conditions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2279816, 2279820, 2279821, 2279825, 2279829, 2279830, 2279831, 2279832, 2279833, 2279834, 2279835, 2279836, 2279837, 2279815, 2279822, 2279823, 2279824, 2279826, 2279827, 2279828, 2279838 | ||
| Bug Blocks: | 2279819 | ||
|
Description
Avinash Hanwate
2024-05-09 04:35:05 UTC
Created golang tracking bugs for this issue: Affects: epel-all [bug 2279815] Affects: fedora-all [bug 2279816] |