Skip to content

Commit 230cf22

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add GO-2024-3333
 - data/reports/GO-2024-3333.yaml Updates #3333 Change-Id: Id9b61dd02b98b6afe8061b66207f9c4d7680ef39 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/637537 Auto-Submit: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]>
1 parent b2e3648 commit 230cf22

File tree

3 files changed

+202
-0
lines changed

3 files changed

+202
-0
lines changed

‎data/cve/v5/GO-2024-3333.json

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2024-45338"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Non-linear parsing of case-insensitive content in golang.org/x/net/html",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "golang.org/x/net",
22+
"product": "golang.org/x/net/html",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "golang.org/x/net/html",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "0.33.0",
29+
"status": "affected",
30+
"versionType": "semver"
31+
}
32+
],
33+
"programRoutines": [
34+
{
35+
"name": "parseDoctype"
36+
},
37+
{
38+
"name": "htmlIntegrationPoint"
39+
},
40+
{
41+
"name": "inTableIM"
42+
},
43+
{
44+
"name": "inBodyIM"
45+
},
46+
{
47+
"name": "Parse"
48+
},
49+
{
50+
"name": "ParseFragment"
51+
},
52+
{
53+
"name": "ParseFragmentWithOptions"
54+
},
55+
{
56+
"name": "ParseWithOptions"
57+
}
58+
],
59+
"defaultStatus": "unaffected"
60+
}
61+
],
62+
"problemTypes": [
63+
{
64+
"descriptions": [
65+
{
66+
"lang": "en",
67+
"description": "CWE-405: Asymmetric Resource Consumption (Amplification)"
68+
}
69+
]
70+
}
71+
],
72+
"references": [
73+
{
74+
"url": "https://go.dev/cl/637536"
75+
},
76+
{
77+
"url": "https://go.dev/issue/70906"
78+
},
79+
{
80+
"url": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ"
81+
},
82+
{
83+
"url": "https://pkg.go.dev/vuln/GO-2024-3333"
84+
}
85+
],
86+
"credits": [
87+
{
88+
"lang": "en",
89+
"value": "Guido Vranken"
90+
}
91+
]
92+
}
93+
}
94+
}

‎data/osv/GO-2024-3333.json

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3333",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-45338"
8+
],
9+
"summary": "Non-linear parsing of case-insensitive content in golang.org/x/net/html",
10+
"details": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
11+
"affected": [
12+
{
13+
"package": {
14+
"name": "golang.org/x/net",
15+
"ecosystem": "Go"
16+
},
17+
"ranges": [
18+
{
19+
"type": "SEMVER",
20+
"events": [
21+
{
22+
"introduced": "0"
23+
},
24+
{
25+
"fixed": "0.33.0"
26+
}
27+
]
28+
}
29+
],
30+
"ecosystem_specific": {
31+
"imports": [
32+
{
33+
"path": "golang.org/x/net/html",
34+
"symbols": [
35+
"Parse",
36+
"ParseFragment",
37+
"ParseFragmentWithOptions",
38+
"ParseWithOptions",
39+
"htmlIntegrationPoint",
40+
"inBodyIM",
41+
"inTableIM",
42+
"parseDoctype"
43+
]
44+
}
45+
]
46+
}
47+
}
48+
],
49+
"references": [
50+
{
51+
"type": "FIX",
52+
"url": "https://go.dev/cl/637536"
53+
},
54+
{
55+
"type": "REPORT",
56+
"url": "https://go.dev/issue/70906"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ"
61+
}
62+
],
63+
"credits": [
64+
{
65+
"name": "Guido Vranken"
66+
}
67+
],
68+
"database_specific": {
69+
"url": "https://pkg.go.dev/vuln/GO-2024-3333",
70+
"review_status": "REVIEWED"
71+
}
72+
}

‎data/reports/GO-2024-3333.yaml

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
id: GO-2024-3333
2+
modules:
3+
- module: golang.org/x/net
4+
versions:
5+
- fixed: 0.33.0
6+
vulnerable_at: 0.32.0
7+
packages:
8+
- package: golang.org/x/net/html
9+
symbols:
10+
- parseDoctype
11+
- htmlIntegrationPoint
12+
- inTableIM
13+
- inBodyIM
14+
derived_symbols:
15+
- Parse
16+
- ParseFragment
17+
- ParseFragmentWithOptions
18+
- ParseWithOptions
19+
summary: Non-linear parsing of case-insensitive content in golang.org/x/net/html
20+
description: |-
21+
An attacker can craft an input to the Parse functions that would be processed
22+
non-linearly with respect to its length, resulting in extremely slow parsing.
23+
This could cause a denial of service.
24+
credits:
25+
- Guido Vranken
26+
references:
27+
- fix: https://go.dev/cl/637536
28+
- report: https://go.dev/issue/70906
29+
- web: https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ
30+
cve_metadata:
31+
id: CVE-2024-45338
32+
cwe: 'CWE-405: Asymmetric Resource Consumption (Amplification)'
33+
source:
34+
id: go-security-team
35+
created: 2024-12-18T15:03:33.947657-05:00
36+
review_status: REVIEWED

0 commit comments

Comments
 (0)