search

ilan-WS / m3

M3 monorepo - Distributed TSDB, Aggregator and Query Engine, Prometheus Sidecar, Graphite Compatible, Metrics Platform
https://m3db.io/
Apache License 2.0
0 stars 0 forks source link

CVE-2022-41723 (High) detected in github.com/golang/net/http2/hpack-v0.1.0 #124

Open mend-for-github-com[bot] opened 1 year ago

mend-for-github-com[bot] commented 1 year ago

CVE-2022-41723 - High Severity Vulnerability

Vulnerable Library - github.com/golang/net/http2/hpack-v0.1.0

[mirror] Go supplementary network libraries

Dependency Hierarchy: - github.com/m3db/m3/src/query/functions/tag-a6995b403d76d304f048402de65df060ccc5c09e (Root Library) - github.com/m3db/m3/src/query/parser-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/query/functions/linear-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/query/functions/lazy-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/query/executor/transform-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/query/storage-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/dbnode/namespace-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/x/ident-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/x/context-a6995b403d76d304f048402de65df060ccc5c09e - github.com/m3db/m3/src/x/opentracing-docs/v1.0 - github.com/lightstep/lightstep-tracer-go-v0.24.1-0.20210527224020-de09fbeeb3df - github.com/lightstep/lightstep-tracer-common/golang/gogo/metricspb-a8dfcb80d3a7f65dcc7767e09e74d1337793bbfd - google.golang.org/grpc-v0.0.0-20210526223527-2de42fcbbce3 - github.com/grpc/grpc-go/internal-v1.40.0-dev - :x: **github.com/golang/net/http2/hpack-v0.1.0** (Vulnerable Library)

Found in HEAD commit: a62d2ead44380e2c1668bbbf026d5385b98d56ec

Found in base branch: master

Vulnerability Details

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Publish Date: 2023-02-28

URL: CVE-2022-41723

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2023-1568

Release Date: 2022-09-29

Fix Resolution: v0.7.0