Red Hat Security Advisory: git-lfs security and bug fix update

Fixed packages 3

Vulnerabilities 10

• High 7.5
  CVE-2022-27664

  golang.org/x/net/http2 Denial of Service vulnerability

  In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-optuna-enas Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2022
• High 7.5
  CVE-2022-30630

  Stack exhaustion in Glob on certain paths in io/fs

  Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

  Go standard library io/fs golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• High 7.5
  CVE-2022-30635

  Stack exhaustion when decoding certain messages in encoding/gob

  Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

  Go standard library encoding/gob golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.5
  CVE-2022-1705

  Improper sanitization of Transfer-Encoding headers in net/http

  Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.5
  CVE-2022-32148

  Exposure of client IP addresses in net/http

  Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-30632

  Stack exhaustion on crafted paths in path/filepath

  Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

  Go standard library path/filepath golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Unscored —
  CVE-2022-32189

  Panic when decoding Float and Rat types in math/big

  A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

  Go standard library math/big golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2113814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132872
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2139383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2161274
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2357.json
• report
  https://access.redhat.com/security/cve/CVE-2022-1705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1705
• article
  https://go.dev/issue/53188
• article
  https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
• report
  https://access.redhat.com/security/cve/CVE-2022-2880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2880
• article
  https://github.com/golang/go/issues/54663
• article
  https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
• report
  https://access.redhat.com/security/cve/CVE-2022-27664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27664
• article
  https://go.dev/issue/54658
• article
  https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ
• report
  https://access.redhat.com/security/cve/CVE-2022-30630
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30630
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-30630
• article
  https://go.dev/issue/53415
• report
  https://access.redhat.com/security/cve/CVE-2022-30632
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30632
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-30632
• article
  https://go.dev/issue/53416
• report
  https://access.redhat.com/security/cve/CVE-2022-30635
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-30635