From: Vijay Anusuri <vanus...@mvista.com>
Upstream-Status: Backport from
https://github.com/golang/go/commit/e55d7cf8435ba4e58d4a5694e63b391821d4ee9b
Signed-off-by: Vijay Anusuri <vanus...@mvista.com>
---
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2023-45288.patch | 95 +++++++++++++++++++
2 files changed, 96 insertions(+)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2023-45288.patch
diff --git a/meta/recipes-devtools/go/go-1.17.13.inc
b/meta/recipes-devtools/go/go-1.17.13.inc
index 768961de2c..95fb572362 100644
--- a/meta/recipes-devtools/go/go-1.17.13.inc
+++ b/meta/recipes-devtools/go/go-1.17.13.inc
@@ -55,6 +55,7 @@ SRC_URI += "\
file://CVE-2023-45290.patch \
file://CVE-2024-24784.patch \
file://CVE-2024-24785.patch \
+ file://CVE-2023-45288.patch \
"
SRC_URI[main.sha256sum] =
"a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd"
diff --git a/meta/recipes-devtools/go/go-1.18/CVE-2023-45288.patch
b/meta/recipes-devtools/go/go-1.18/CVE-2023-45288.patch
new file mode 100644
index 0000000000..741e7be89a
--- /dev/null
+++ b/meta/recipes-devtools/go/go-1.18/CVE-2023-45288.patch
@@ -0,0 +1,95 @@
+From e55d7cf8435ba4e58d4a5694e63b391821d4ee9b Mon Sep 17 00:00:00 2001
+From: Damien Neil <dn...@google.com>
+Date: Thu, 28 Mar 2024 16:57:51 -0700
+Subject: [PATCH] [release-branch.go1.22] net/http: update bundled
+ golang.org/x/net/http2
+
+Disable cmd/internal/moddeps test, since this update includes PRIVATE
+track fixes.
+
+Fixes CVE-2023-45288
+For #65051
+Fixes #66298
+
+Change-Id: I5bbf774ebe7651e4bb7e55139d3794bd2b8e8fa8
+Reviewed-on:
https://team-review.git.corp.google.com/c/golang/go-private/+/2197227
+Reviewed-by: Tatiana Bradley <tatianabrad...@google.com>
+Run-TryBot: Damien Neil <dn...@google.com>
+Reviewed-by: Dmitri Shuralyov <dmits...@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/576076
+Auto-Submit: Dmitri Shuralyov <dmits...@google.com>
+TryBot-Bypass: Dmitri Shuralyov <dmits...@google.com>
+Reviewed-by: Than McIntosh <th...@google.com>
+
+Upstream-Status: Backport
[https://github.com/golang/go/commit/e55d7cf8435ba4e58d4a5694e63b391821d4ee9b]
+CVE: CVE-2023-45288
+Signed-off-by: Vijay Anusuri <vanus...@mvista.com>
+---
+ src/cmd/internal/moddeps/moddeps_test.go | 1 +
+ src/net/http/h2_bundle.go | 31 ++++++++++++++++++++++++
+ 2 files changed, 32 insertions(+)
+
+diff --git a/src/cmd/internal/moddeps/moddeps_test.go
b/src/cmd/internal/moddeps/moddeps_test.go
+index d48d43f..250bde4 100644
+--- a/src/cmd/internal/moddeps/moddeps_test.go
++++ b/src/cmd/internal/moddeps/moddeps_test.go
+@@ -34,6 +34,7 @@ import (
+ // See issues 36852, 41409, and 43687.
+ // (Also see golang.org/issue/27348.)
+ func TestAllDependencies(t *testing.T) {
++ t.Skip("TODO(#65051): 1.22.2 contains unreleased changes from vendored
modules")
+ t.Skip("TODO(#57009): 1.19.4 contains unreleased changes from vendored
modules")
+ t.Skip("TODO(#53977): 1.18.5 contains unreleased changes from vendored
modules")
+
+diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go
+index 9d6abd8..10ff193 100644
+--- a/src/net/http/h2_bundle.go
++++ b/src/net/http/h2_bundle.go
+@@ -2842,6 +2842,7 @@ func (fr *http2Framer) readMetaFrame(hf
*http2HeadersFrame) (*http2MetaHeadersFr
+ if size > remainSize {
+ hdec.SetEmitEnabled(false)
+ mh.Truncated = true
++ remainSize = 0
+ return
+ }
+ remainSize -= size
+@@ -2854,6 +2855,36 @@ func (fr *http2Framer) readMetaFrame(hf
*http2HeadersFrame) (*http2MetaHeadersFr
+ var hc http2headersOrContinuation = hf
+ for {
+ frag := hc.HeaderBlockFragment()
++
++ // Avoid parsing large amounts of headers that we will then
discard.
++ // If the sender exceeds the max header list size by too much,
++ // skip parsing the fragment and close the connection.
++ //
++ // "Too much" is either any CONTINUATION frame after we've
already
++ // exceeded the max header list size (in which case remainSize
is 0),
++ // or a frame whose encoded size is more than twice the
remaining
++ // header list bytes we're willing to accept.
++ if int64(len(frag)) > int64(2*remainSize) {
++ if http2VerboseLogs {
++ log.Printf("http2: header list too large")
++ }
++ // It would be nice to send a RST_STREAM before sending
the GOAWAY,
++ // but the struture of the server's frame writer makes
this difficult.
++ return nil, http2ConnectionError(http2ErrCodeProtocol)
++ }
++
++ // Also close the connection after any CONTINUATION frame
following an
++ // invalid header, since we stop tracking the size of the
headers after
++ // an invalid one.
++ if invalid != nil {
++ if http2VerboseLogs {
++ log.Printf("http2: invalid header: %v", invalid)
++ }
++ // It would be nice to send a RST_STREAM before sending
the GOAWAY,
++ // but the struture of the server's frame writer makes
this difficult.
++ return nil, http2ConnectionError(http2ErrCodeProtocol)
++ }
++
+ if _, err := hdec.Write(frag); err != nil {
+ return nil,
http2ConnectionError(http2ErrCodeCompression)
+ }
+--
+2.25.1
+
--
2.25.1
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#198495):
https://lists.openembedded.org/g/openembedded-core/message/198495
Mute This Topic: https://lists.openembedded.org/mt/105592204/21656
Group Owner: openembedded-core+ow...@lists.openembedded.org
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
