search

celo-org / celo-blockchain

Official repository for the golang Celo Blockchain
https://celo.org
GNU Lesser General Public License v3.0
560 stars 198 forks source link

chore(deps): update module golang.org/x/net to v0.23.0 [security] #2296

Closed renovate[bot] closed 6 months ago

renovate[bot] commented 6 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
golang.org/x/net v0.17.0 -> v0.23.0 age adoption passing confidence

HTTP/2 CONTINUATION flood in net/http

BIT-golang-2023-45288 / CVE-2023-45288 / GO-2024-2687

More information #### Details An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection. #### Severity Unknown #### References - [https://go.dev/issue/65051](https://go.dev/issue/65051) - [https://go.dev/cl/576155](https://go.dev/cl/576155) - [https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M](https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2024-2687) and the [Go Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY 4.0](https://togithub.com/golang/vulndb#license)).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

github-actions[bot] commented 6 months ago

Coverage from tests in ./e2e_test/... for ./consensus/istanbul/... at commit 7859a7830e69b2b1933d0ccd5ab2058c344b0e19

coverage: 50.7% of statements across all listed packages 
coverage:  63.4% of statements in consensus/istanbul
coverage:  42.7% of statements in consensus/istanbul/announce
coverage:  55.7% of statements in consensus/istanbul/backend
coverage:   0.0% of statements in consensus/istanbul/backend/backendtest
coverage:  24.3% of statements in consensus/istanbul/backend/internal/replica
coverage:  64.6% of statements in consensus/istanbul/core
coverage:  50.0% of statements in consensus/istanbul/db
coverage:   0.0% of statements in consensus/istanbul/proxy
coverage:  64.2% of statements in consensus/istanbul/uptime
coverage:  51.8% of statements in consensus/istanbul/validator
coverage:  79.2% of statements in consensus/istanbul/validator/random
github-actions[bot] commented 6 months ago

5871 passed, 1 failed, 44 skipped

Test failures:
  TestMiner: miner

Failed
/runner/_work/celo-blockchain/celo-blockchain/consensus/consensustest/mockprotocol.go:384 +0x181
/runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:466 +0xb3
/runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:308 +0x515
/runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:410 +0x3b
/runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:409 +0x1aa
This test report was produced by the test-summary action.  Made with ❤️ in Cambridge.