Bug 2295310 (CVE-2024-24791)
| Summary: | CVE-2024-24791 net/http: Denial of service due to improper 100-continue handling in net/http | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, abarbaro, adudiak, ahanwate, akostadi, alcohan, amasferr, amctagga, anjoseph, ansmith, anthomas, aoconnor, bbuckingham, bniver, brking, cbartlet, cdaley, chazlett, chfoley, cmah, danken, darunesh, debarshir, dfreiber, dhanak, dholler, dkenigsb, dmayorov, drow, dsimansk, dymurray, eaguilar, ebaron, eglynn, ehelms, epacific, fdeutsch, flucifre, ggainey, gkamathe, gmeno, gparvin, gsuckevi, haoli, hkataria, ibolton, jajackso, jburrell, jcammara, jcantril, jchui, jforrest, jhardy, jhe, jjoyce, jkang, jkoehler, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jobarker, jolong, jpallich, jprabhak, jschluet, jscholz, juwatts, kaycoth, kegrant, kholdawa, kingland, koliveir, kshier, ktsao, kverlaen, lbainbri, lchilton, lcouzens, lgamliel, lhh, lphiri, lsvaty, mabashia, manissin, matzew, mbenjamin, mbocek, mburns, mgarciac, mhackett, mhulan, mkudlej, mmagr, mmakovy, mnovotny, mrajanna, mrunge, mskarbek, mwringe, nboldt, njean, nmoumoul, nobody, nsoni, odf-bz-bot, omaciel, oramraz, osousa, owatkins, pahickey, pbraun, pcreech, peholase, pgaikwad, pgrist, phoracek, pierdipi, pjindal, psampaio, psrna, rchan, rfreiman, rguimara, rhaigner, rhos-maint, rhuss, rjohnson, rojacob, rtaniwa, sakbas, saroy, sausingh, sdawley, sfeifer, sfroberg, shvarugh, simaishi, sipoyare, slucidi, smallamp, smcdonal, smullick, sostapov, sseago, stcannon, stirabos, swoodman, teagle, tfister, thason, thavo, tjochec, tkral, tsweeney, vereddy, vimartin, vkumar, whayutin, wtam, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | psampaio:
needinfo?
(darunesh) |
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2297326, 2350496, 2297318, 2297320, 2297321, 2297323, 2297324, 2297325, 2297327, 2297328, 2297329, 2297619, 2297620 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2024-07-02 22:00:22 UTC
Created golang tracking bugs for this issue: Affects: fedora-all [bug 2297318] There is something wrong with this CVE tracker bug. The CVE is in Go's standard net/http package, which is part of the golang RPM. However, I don't see any mention of golang here. I also don't see any mention of prominent RPMs that use Go and might need to rebuilt against a golang, where the CVE is fixed. eg., podman and toolbox. However, I do know about the existence of two toolbox Jira issues that were filed for this CVE: https://issues.redhat.com/browse/RHEL-47194 https://issues.redhat.com/browse/RHEL-47199 So, it seems like something went wrong where this tracker bug doesn't depend on all the corresponding child issues and bugs. This isn't just an academic problem, because I use this metadata to figure out the corresponding golang issues to know when the CVE would get fixed in golang, so that builds can be done against it. (In reply to Debarshi Ray from comment #12) > There is something wrong with this CVE tracker bug. > > The CVE is in Go's standard net/http package, which is part of the golang > RPM. However, I don't see any mention of golang here. I also don't see any > mention of prominent RPMs that use Go and might need to rebuilt against a > golang, where the CVE is fixed. eg., podman and toolbox. However, I do > know about the existence of two toolbox Jira issues that were filed for this > CVE: > https://issues.redhat.com/browse/RHEL-47194 > https://issues.redhat.com/browse/RHEL-47199 I did some digging, and the corresponding golang bugs are: https://issues.redhat.com/browse/RHEL-47200 https://issues.redhat.com/browse/RHEL-47161 This issue has been addressed in the following products: Cryostat 3 on RHEL 8 Via RHSA-2024:5537 https://access.redhat.com/errata/RHSA-2024:5537 This issue has been addressed in the following products: Cost Management for RHEL 8 Via RHSA-2024:6462 https://access.redhat.com/errata/RHSA-2024:6462 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:6914 https://access.redhat.com/errata/RHSA-2024:6914 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:6908 https://access.redhat.com/errata/RHSA-2024:6908 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:6913 https://access.redhat.com/errata/RHSA-2024:6913 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:6912 https://access.redhat.com/errata/RHSA-2024:6912 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:6969 https://access.redhat.com/errata/RHSA-2024:6969 This issue has been addressed in the following products: NETWORK-OBSERVABILITY-1.6.0-RHEL-9 Via RHSA-2024:7074 https://access.redhat.com/errata/RHSA-2024:7074 This issue has been addressed in the following products: OpenShift Custom Metrics Autoscaler 2 Via RHSA-2024:7348 https://access.redhat.com/errata/RHSA-2024:7348 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:7349 https://access.redhat.com/errata/RHSA-2024:7349 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:7922 https://access.redhat.com/errata/RHSA-2024:7922 This issue has been addressed in the following products: KDO-5.1-RHEL-9 Via RHSA-2024:6341 https://access.redhat.com/errata/RHSA-2024:6341 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:8260 https://access.redhat.com/errata/RHSA-2024:8260 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.15 Via RHSA-2024:8425 https://access.redhat.com/errata/RHSA-2024:8425 Redirecting needinfo from comment#12. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2024:8688 https://access.redhat.com/errata/RHSA-2024:8688 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2024:8692 https://access.redhat.com/errata/RHSA-2024:8692 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.14 Via RHSA-2024:8697 https://access.redhat.com/errata/RHSA-2024:8697 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9089 https://access.redhat.com/errata/RHSA-2024:9089 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9097 https://access.redhat.com/errata/RHSA-2024:9097 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9098 https://access.redhat.com/errata/RHSA-2024:9098 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9102 https://access.redhat.com/errata/RHSA-2024:9102 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9115 https://access.redhat.com/errata/RHSA-2024:9115 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9135 https://access.redhat.com/errata/RHSA-2024:9135 This issue has been addressed in the following products: OSSO-1.2-RHEL-9 Via RHSA-2024:8219 https://access.redhat.com/errata/RHSA-2024:8219 This issue has been addressed in the following products: OADP-1.3-RHEL-9 Via RHSA-2024:9960 https://access.redhat.com/errata/RHSA-2024:9960 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2024:10133 https://access.redhat.com/errata/RHSA-2024:10133 This issue has been addressed in the following products: RHEL-9-CNV-4.13 Via RHSA-2024:10389 https://access.redhat.com/errata/RHSA-2024:10389 This issue has been addressed in the following products: RHEL-8-CNV-4.12 Via RHSA-2024:10758 https://access.redhat.com/errata/RHSA-2024:10758 This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.8 Via RHSA-2024:10906 https://access.redhat.com/errata/RHSA-2024:10906 This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2025:0082 https://access.redhat.com/errata/RHSA-2025:0082 This issue has been addressed in the following products: Streams for Apache Kafka 2.9.0 Via RHSA-2025:2416 https://access.redhat.com/errata/RHSA-2025:2416 This issue has been addressed in the following products: RHEL-9-CNV-4.16 Via RHSA-2025:3973 https://access.redhat.com/errata/RHSA-2025:3973 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:7256 https://access.redhat.com/errata/RHSA-2025:7256 |