csaf_redhat - rhsa-2025

rhsa-2025_0385

Vulnerability from csaf_redhat

Published

2025-01-16 18:08

Modified

2025-03-25 11:09

Summary

Red Hat Security Advisory: VolSync 0.11.1 for RHEL 9

Notes

Topic

VolSync v0.11.1 general availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Details

VolSync v0.11.1 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, it can create and maintain copies of your persistent data. For more information about VolSync, see: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/business_continuity/business-cont-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/. This advisory contains enhancements and updates to the VolSync container images. Security fix(es): * quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (CVE-2024-53259) * golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CVE-2024-45337) * golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "VolSync v0.11.1 general availability release images, which provide\nenhancements, security fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "VolSync v0.11.1 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying\nthe VolSync operator, it can create and maintain copies of your persistent\ndata.\n\nFor more information about VolSync, see:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.10/html/business_continuity/business-cont-overview#volsync\n\nor the VolSync open source community website at:\nhttps://volsync.readthedocs.io/en/stable/.\n\nThis advisory contains enhancements and updates to the VolSync\ncontainer images.\n\nSecurity fix(es):\n\n* quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (CVE-2024-53259) \n* golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause\nauthorization bypass in golang.org/x/crypto (CVE-2024-45337)\n* golang.org/x/net/html: Non-linear parsing of case-insensitive content in\ngolang.org/x/net/html (CVE-2024-45338)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:0385",
        "url": "https://access.redhat.com/errata/RHSA-2025:0385"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2329991",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2329991"
      },
      {
        "category": "external",
        "summary": "2331720",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331720"
      },
      {
        "category": "external",
        "summary": "2333122",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333122"
      },
      {
        "category": "external",
        "summary": "ACM-16525",
        "url": "https://issues.redhat.com/browse/ACM-16525"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0385.json"
      }
    ],
    "title": "Red Hat Security Advisory: VolSync 0.11.1 for RHEL 9",
    "tracking": {
      "current_release_date": "2025-03-25T11:09:01+00:00",
      "generator": {
        "date": "2025-03-25T11:09:01+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.4.1"
        }
      },
      "id": "RHSA-2025:0385",
      "initial_release_date": "2025-01-16T18:08:53+00:00",
      "revision_history": [
        {
          "date": "2025-01-16T18:08:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-01-16T18:08:53+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-03-25T11:09:01+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9",
                  "product_id": "9Base-RHACM-2.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2.12::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat ACM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
                  "product_id": "rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0?arch=s390x\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.11.1-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64",
                  "product_id": "rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.11.1-2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
                "product": {
                  "name": "rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
                  "product_id": "rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a?arch=amd64\u0026repository_url=registry.redhat.io/rhacm2/volsync-operator-bundle\u0026tag=v0.11.1-3"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
                  "product_id": "rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34?arch=ppc64le\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.11.1-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
                "product": {
                  "name": "rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
                  "product_id": "rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7?arch=arm64\u0026repository_url=registry.redhat.io/rhacm2/volsync-rhel9\u0026tag=v0.11.1-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9",
          "product_id": "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64"
        },
        "product_reference": "rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
        "relates_to_product_reference": "9Base-RHACM-2.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9",
          "product_id": "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
        "relates_to_product_reference": "9Base-RHACM-2.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9",
          "product_id": "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
        "relates_to_product_reference": "9Base-RHACM-2.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9",
          "product_id": "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
        "relates_to_product_reference": "9Base-RHACM-2.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9",
          "product_id": "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
        },
        "product_reference": "rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64",
        "relates_to_product_reference": "9Base-RHACM-2.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-45337",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2024-12-11T19:00:54.247490+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2331720"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is classified as important rather than critical because it does not directly enable unauthorized access but rather introduces a risk of authorization bypass if the application or library misuses the PublicKeyCallback API. The vulnerability relies on incorrect assumptions made by the application when handling the sequence or state of keys provided during SSH authentication. Properly implemented systems that use the Permissions field or avoid relying on external state remain unaffected. Additionally, the vulnerability does not allow direct exploitation to gain control over a system without the presence of insecure logic in the application\u0027s handling of authentication attempts.\n\n\nRed Hat Enterprise Linux(RHEL) 8 \u0026 9 and Red Hat Openshift marked as not affected as it was determined that the problem function `ServerConfig.PublicKeyCallback`, as noted in the CVE-2024-45337 issue, is not called by Podman, Buildah, containers-common, or the gvisor-tap-vsock projects.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "RHBZ#2331720",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331720"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45337",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909",
          "url": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/635315",
          "url": "https://go.dev/cl/635315"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/70779",
          "url": "https://go.dev/issue/70779"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ",
          "url": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3321",
          "url": "https://pkg.go.dev/vuln/GO-2024-3321"
        }
      ],
      "release_date": "2024-12-11T18:55:58.506000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-16T18:08:53+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/business_continuity/business-cont-overview#volsync",
          "product_ids": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0385"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto"
    },
    {
      "cve": "CVE-2024-45338",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2024-12-18T21:00:59.938173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2333122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. This flaw allows an attacker to craft input to the parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This issue can cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because an attacker can craft malicious input that causes the parsing functions to process data non-linearly, resulting in significant delays which leads to a denial of service by exhausting system resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "RHBZ#2333122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-45338",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45338",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/637536",
          "url": "https://go.dev/cl/637536"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/70906",
          "url": "https://go.dev/issue/70906"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ",
          "url": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-3333",
          "url": "https://pkg.go.dev/vuln/GO-2024-3333"
        }
      ],
      "release_date": "2024-12-18T20:38:22.660000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-16T18:08:53+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/business_continuity/business-cont-overview#volsync",
          "product_ids": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0385"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html"
    },
    {
      "cve": "CVE-2024-53259",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2024-12-02T17:01:10.568793+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2329991"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a \"message too large\" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they\u0027re unable to establish a QUIC connection). The attacker needs to at least know the client\u0027s IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
          "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-53259"
        },
        {
          "category": "external",
          "summary": "RHBZ#2329991",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2329991"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-53259",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-53259"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-53259",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53259"
        },
        {
          "category": "external",
          "summary": "https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50",
          "url": "https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50"
        },
        {
          "category": "external",
          "summary": "https://github.com/quic-go/quic-go/pull/4729",
          "url": "https://github.com/quic-go/quic-go/pull/4729"
        },
        {
          "category": "external",
          "summary": "https://github.com/quic-go/quic-go/releases/tag/v0.48.2",
          "url": "https://github.com/quic-go/quic-go/releases/tag/v0.48.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr",
          "url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr"
        }
      ],
      "release_date": "2024-12-02T16:12:40.605000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-16T18:08:53+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/business_continuity/business-cont-overview#volsync",
          "product_ids": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:0385"
        },
        {
          "category": "workaround",
          "details": "Use iptables to drop ICMP unreachable packets.",
          "product_ids": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHACM-2.12:rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x",
            "9Base-RHACM-2.12:rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux"
    }
  ]
}

cve-2024-45337

Vulnerability from cvelistv5

Published

2024-12-11 18:55

Modified

2025-02-18 20:48

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

References

▼	URL	Tags
	https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909
	https://go.dev/cl/635315
	https://go.dev/issue/70779
	https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ
	https://pkg.go.dev/vuln/GO-2024-3321

Impacted products

▼	Vendor	Product
	golang.org/x/crypto	golang.org/x/crypto/ssh

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-31T15:02:46.088Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/12/11/2"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250131-0007/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45337",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T17:57:55.896008Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T17:58:29.810Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/crypto/ssh",
          "product": "golang.org/x/crypto/ssh",
          "programRoutines": [
            {
              "name": "ServerConfig.PublicKeyCallback"
            },
            {
              "name": "connection.serverAuthenticate"
            },
            {
              "name": "NewServerConn"
            }
          ],
          "vendor": "golang.org/x/crypto",
          "versions": [
            {
              "lessThan": "0.31.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Damien Tournoud (Platform.sh / Upsun)"
        },
        {
          "lang": "en",
          "value": "Patrick Dawkins (Platform.sh / Upsun)"
        },
        {
          "lang": "en",
          "value": "Vince Parker (Platform.sh / Upsun)"
        },
        {
          "lang": "en",
          "value": "Jules Duvivier (Platform.sh / Upsun)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1108: Excessive Reliance on Global Variables",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-18T20:48:40.404Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"
        },
        {
          "url": "https://go.dev/cl/635315"
        },
        {
          "url": "https://go.dev/issue/70779"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-3321"
        }
      ],
      "title": "Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-45337",
    "datePublished": "2024-12-11T18:55:58.506Z",
    "dateReserved": "2024-08-27T19:41:58.555Z",
    "dateUpdated": "2025-02-18T20:48:40.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-45338

Vulnerability from cvelistv5

Published

2024-12-18 20:38

Modified

2025-02-21 18:03

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

Non-linear parsing of case-insensitive content in golang.org/x/net/html

References

▼	URL	Tags
	https://go.dev/cl/637536
	https://go.dev/issue/70906
	https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
	https://pkg.go.dev/vuln/GO-2024-3333

Impacted products

▼	Vendor	Product
	golang.org/x/net	golang.org/x/net/html

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45338",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-31T19:51:42.228627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1333",
                "description": "CWE-1333 Inefficient Regular Expression Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-31T19:55:04.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:32.301Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/html",
          "product": "golang.org/x/net/html",
          "programRoutines": [
            {
              "name": "parseDoctype"
            },
            {
              "name": "htmlIntegrationPoint"
            },
            {
              "name": "inTableIM"
            },
            {
              "name": "inBodyIM"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseFragment"
            },
            {
              "name": "ParseFragmentWithOptions"
            },
            {
              "name": "ParseWithOptions"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.33.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Guido Vranken"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-405: Asymmetric Resource Consumption (Amplification)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-18T20:38:22.660Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/637536"
        },
        {
          "url": "https://go.dev/issue/70906"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-3333"
        }
      ],
      "title": "Non-linear parsing of case-insensitive content in golang.org/x/net/html"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-45338",
    "datePublished": "2024-12-18T20:38:22.660Z",
    "dateReserved": "2024-08-27T19:41:58.555Z",
    "dateUpdated": "2025-02-21T18:03:32.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-53259

Vulnerability from cvelistv5

Published

2024-12-02 16:12

Modified

2024-12-02 19:28

Severity ?

6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

References

▼	URL	Tags
	https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr	x_refsource_CONFIRM
	https://github.com/quic-go/quic-go/pull/4729	x_refsource_MISC
	https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50	x_refsource_MISC
	https://github.com/quic-go/quic-go/releases/tag/v0.48.2	x_refsource_MISC

Impacted products

▼	Vendor	Product
	quic-go	quic-go

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-53259",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-02T19:27:58.329919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-02T19:28:08.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "quic-go",
          "vendor": "quic-go",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.48.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IP_PMTUDISC_DO, the kernel would then return a \"message too large\" error on sendmsg, i.e. when quic-go attempts to send a packet that exceeds the MTU claimed in that ICMP packet. By setting this value to smaller than 1200 bytes (the minimum MTU for QUIC), the attacker can disrupt a QUIC connection. Crucially, this can be done after completion of the handshake, thereby circumventing any TCP fallback that might be implemented on the application layer (for example, many browsers fall back to HTTP over TCP if they\u0027re unable to establish a QUIC connection). The attacker needs to at least know the client\u0027s IP and port tuple to mount an attack. This vulnerability is fixed in 0.48.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-02T16:12:40.605Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr"
        },
        {
          "name": "https://github.com/quic-go/quic-go/pull/4729",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quic-go/quic-go/pull/4729"
        },
        {
          "name": "https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50"
        },
        {
          "name": "https://github.com/quic-go/quic-go/releases/tag/v0.48.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/quic-go/quic-go/releases/tag/v0.48.2"
        }
      ],
      "source": {
        "advisory": "GHSA-px8v-pp82-rcvr",
        "discovery": "UNKNOWN"
      },
      "title": "quic-go affected by an ICMP Packet Too Large Injection Attack on Linux"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-53259",
    "datePublished": "2024-12-02T16:12:40.605Z",
    "dateReserved": "2024-11-19T20:08:14.480Z",
    "dateUpdated": "2024-12-02T19:28:08.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

rhsa-2025_0385

Vulnerability from csaf_redhat

cve-2024-45337

Vulnerability from cvelistv5

cve-2024-45338

Vulnerability from cvelistv5

cve-2024-53259

Vulnerability from cvelistv5

Tags