Red Hat Bug Fix Advisory: delve, golang, and go-toolset bug fix and enhancement update

Fixed packages 7

Vulnerabilities 3

• High 7.5
  CVE-2022-41723

  Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

  A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023
• Unscored —
  CVE-2022-41724

  Panic on large handshake records in crypto/tls

  Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023
• Unscored —
  CVE-2022-41725

  Excessive resource consumption in mime/multipart

  A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…

  Go standard library mime/multipart katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 28, 2023

References

• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966992
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2137763
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2138231
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2157587
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_2181.json
• report
  https://access.redhat.com/security/cve/CVE-2022-41723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178358
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41723
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41723
• advisory
  https://github.com/advisories/GHSA-vvpx-j8f3-3w6h
• article
  https://go.dev/cl/468135
• article
  https://go.dev/cl/468295
• article
  https://go.dev/issue/57855
• article
  https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
• advisory
  https://pkg.go.dev/vuln/GO-2023-1571
• article
  https://vuln.go.dev/ID/GO-2023-1571.json
• report
  https://access.redhat.com/security/cve/CVE-2022-41724
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178492
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41724
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41724
• article
  https://go.dev/cl/468125
• article
  https://go.dev/issue/58001
• advisory
  https://pkg.go.dev/vuln/GO-2023-1570
• report
  https://access.redhat.com/security/cve/CVE-2022-41725
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2178488
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41725
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41725
• article
  https://go.dev/cl/468124
• article
  https://go.dev/issue/58006
• advisory
  https://pkg.go.dev/vuln/GO-2023-1569