CVE-2024-24791

[devguard-app[bot]]

CVE-2024-24791

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

Affected component

The vulnerability is in pkg:golang/stdlib@1.22.3, detected by the container-scanning scan.

Recommended fix

Upgrade to version 1.22.5 or later.

Risk: 3.45 (Low)

EPSS: 0.04 %

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit: Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability.

Vulnerability Depth: 1

The vulnerability is in a direct dependency of your project.

CVSS-BE: 7.5

• Exploiting this vulnerability significantly impacts availability.

CVSS-B: 7.5

• The vulnerability can be exploited over the network without needing physical access.
• It is easy for an attacker to exploit this vulnerability.
• An attacker does not need any special privileges or access rights.
• No user interaction is needed for the attacker to exploit this vulnerability.
• The impact is confined to the system where the vulnerability exists.
• There is a high impact on the availability of the system.

More details can be found in DevGuard

---

We need to fix this.

[timbastin]

Test

[timbastin]

Wow direkt aus GitHub

[timbastin]

/accept Dieses Risiko ist in Ordnung.

[timbastin]

/reopen Müssen wir doch fixen

[timbastin]

/a Ein alias

[timbastin]

/r Müssen wir doch leider fixen

[devguard-app[bot]]

Tim Bastin commented on the flaw

Noch ein Versuch

[devguard-app[bot]]

Tim Bastin accepted the flaw

Kann ich auch accepten?

[devguard-app[bot]]

Tim Bastin reopened the flaw

Ich möchte es reopen

[devguard-app[bot]]

Tim Bastin marked the flaw as false positive

Das ist ein False-Positive

[timbastin]

/r Reopen flaw

[timbastin]

/r Reopen

[timbastin]

/r Reopen

[timbastin]

/r Test

[timbastin]

/a Accept this risk