From 6b476037f1ac0e09d80fad673f68c6a1ba47a0a7 Mon Sep 17 00:00:00 2001 From: Mayckol Ferreira Date: Fri, 10 Jan 2025 15:13:57 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20chore(go.mod):=20update=20golang?= =?UTF-8?q?.org/x/crypto=20to=20v0.32.0=20GHSA-4v7x-pqxf-cx7m?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - update golang.org/x/crypto from v0.22.0 to v0.32.0 - update go.sum with new checksum entries problem description: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection --- go.mod | 2 +- go.sum | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/go.mod b/go.mod index c4e88d1..83bf186 100644 --- a/go.mod +++ b/go.mod @@ -2,4 +2,4 @@ module github.com/youmark/pkcs8 go 1.17 -require golang.org/x/crypto v0.22.0 +require golang.org/x/crypto v0.32.0 diff --git a/go.sum b/go.sum index ce62e45..97543ad 100644 --- a/go.sum +++ b/go.sum @@ -1,2 +1,4 @@ golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30= golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M= +golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc= +golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=