Summary
Guido Vranken discovered that Go Networking handled input to the Parse
functions inefficiently. An attacker could possibly use this issue to
cause denial of service. This update addresses the issue in the
golang-golang-x-net and golang-golang-x-net-dev packages, as well as the
library vendored within adsys and juju-core.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | adsys | 0.9.2~20.04.2ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | adsys | 0.14.3~22.04ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | adsys | 0.14.3~24.04ubuntu0.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | golang-golang-x-net-dev | 1:0.0+git20160110.4fd4a9f-1ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | juju-core | 2.3.7-0ubuntu0.16.04.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | golang-golang-x-net-dev | 1:0.0+git20170629.c81e7f2+dfsg-2ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | golang-golang-x-net-dev | 1:0.0+git20190811.74dc4d7+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | golang-golang-x-net | 1:0.0+git20211209.491a49a+dfsg-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | golang-golang-x-net | 1:0.21.0+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Medium 5.3
Non-linear parsing of case-insensitive content in golang.org/x/net/html
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
References
-
report
https://ubuntu.com/security/CVE-2024-45338