CVE-2017-1000098: High severity golang vulnerability
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000098?
CVE-2017-1000098 is classified as a medium severity vulnerability due to the potential for denial of service through resource exhaustion.
How do I fix CVE-2017-1000098?
To fix CVE-2017-1000098, upgrade to Go version 1.6.4 or higher, or to version 1.7.4 or higher.
What type of attack does CVE-2017-1000098 enable?
CVE-2017-1000098 enables denial of service attacks by exhausting the server's file descriptors.
Which versions of Go are affected by CVE-2017-1000098?
Go versions prior to 1.6.4 and versions between 1.7.0 and 1.7.4 are affected by CVE-2017-1000098.
What impact does CVE-2017-1000098 have on web applications?
CVE-2017-1000098 can lead to server crashes or slowdowns, affecting the availability of web applications.