golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9: 3 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.0.0-20211123203042-d83791d6bcd9.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Found in HEAD commit: fd9fc1baf3cd86beecdfe1d4b962b3e768b4ff92

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (golang.org/x/net-v0.0.0 version)	Remediation Possible**
CVE-2022-41721	High	7.5	golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9	Direct	v0.2.0	✅
CVE-2022-27664	High	7.5	golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9	Direct	golang.org/x/net - 0.0.0-20220906165146-f3363e06e74c, go1.18.6, go1.19.1	✅
CVE-2021-44716	High	7.5	golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9	Direct	github.com/golang/net - 491a49abca63de5e07ef554052d180a1b5fe2d70	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-41721

Vulnerable Library - golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.0.0-20211123203042-d83791d6bcd9.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy:

• ❌ golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9 (Vulnerable Library)

Found in HEAD commit: fd9fc1baf3cd86beecdfe1d4b962b3e768b4ff92

Found in base branch: master

Vulnerability Details

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Publish Date: 2023-01-13

URL: CVE-2022-41721

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-13

Fix Resolution: v0.2.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-27664

Vulnerable Library - golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.0.0-20211123203042-d83791d6bcd9.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy:

• ❌ golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9 (Vulnerable Library)

Found in HEAD commit: fd9fc1baf3cd86beecdfe1d4b962b3e768b4ff92

Found in base branch: master

Vulnerability Details

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Publish Date: 2022-09-06

URL: CVE-2022-27664

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pkg.go.dev/vuln/GO-2022-0969

Release Date: 2022-09-06

Fix Resolution: golang.org/x/net - 0.0.0-20220906165146-f3363e06e74c, go1.18.6, go1.19.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-44716

Vulnerable Library - golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.0.0-20211123203042-d83791d6bcd9.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy:

• ❌ golang.org/x/net-v0.0.0-20211123203042-d83791d6bcd9 (Vulnerable Library)

Found in HEAD commit: fd9fc1baf3cd86beecdfe1d4b962b3e768b4ff92

Found in base branch: master

Vulnerability Details

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

Publish Date: 2022-01-01

URL: CVE-2021-44716

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vc3p-29h2-gpcp

Release Date: 2022-01-01

Fix Resolution: github.com/golang/net - 491a49abca63de5e07ef554052d180a1b5fe2d70

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.