Now
MAIN commitmail json YAML
pkgsrc/lang/go/version.mk@1.206
/
diff
pkgsrc/lang/go121/PLIST@1.9 / diff
pkgsrc/lang/go121/distinfo@1.11 / diff
pkgsrc/lang/go121/PLIST@1.9 / diff
pkgsrc/lang/go121/distinfo@1.11 / diff
go121: Update to 1.21.9.
This minor release includes 1 security fix following the security policy:
http2: close connections when receiving too many headers
Maintaining HPACK state requires that we parse and process all HEADERS and
CONTINUATION frames on a connection. When a request's headers exceed
MaxHeaderBytes, we don't allocate memory to store the excess headers but we do
parse them. This permits an attacker to cause an HTTP/2 endpoint to read
arbitrary amounts of header data, all associated with a request which is going
to be rejected. These headers can include Huffman-encoded data which is
significantly more expensive for the receiver to decode than for an attacker to
send.
Set a limit on the amount of excess header frames we will process before
closing a connection.
Thanks to Bartek Nowotarski (https://nowotarski.info/) for reporting this
issue.
This is CVE-2023-45288 and Go issue https://go.dev/issue/65051.
This minor release includes 1 security fix following the security policy:
http2: close connections when receiving too many headers
Maintaining HPACK state requires that we parse and process all HEADERS and
CONTINUATION frames on a connection. When a request's headers exceed
MaxHeaderBytes, we don't allocate memory to store the excess headers but we do
parse them. This permits an attacker to cause an HTTP/2 endpoint to read
arbitrary amounts of header data, all associated with a request which is going
to be rejected. These headers can include Huffman-encoded data which is
significantly more expensive for the receiver to decode than for an attacker to
send.
Set a limit on the amount of excess header frames we will process before
closing a connection.
Thanks to Bartek Nowotarski (https://nowotarski.info/) for reporting this
issue.
This is CVE-2023-45288 and Go issue https://go.dev/issue/65051.