https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ announces the release of Go versions 1.24.1 and 1.23.7, including a security fix for: net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs
Matching of hosts against proxy patterns could improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable was set to ".example.com", a request to "[::1%25.example.com]:80 would incorrectly match and not be proxied.
Thanks to Juho Forsén of Mattermost for reporting this issue.
This is CVE-2025-22870 and Go issue https://go.dev/issue/71984. -- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2.
Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.
End of life: 2/11/2025, Latest version: 1.22.12
End of life: 2/11/2025, Latest version: 1.22.12
End of life: 8/13/2024, Latest version: 1.21.13
End of life: 8/13/2024, Latest version: 1.21.13
[I've seen multiple news articles & blogs in the wake of the coordinated disclosure today, but no postings here yet, so lets start fixing that.]
Google, Cloudflare, AWS, and others released details today of a protocol-level issue in HTTP/2 being exploited in recent months for denial-of-service attacks:
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ https://aws.amazon.com/blogs/security/how-aws-protects-customers-from-ddos-events/
This attack works via the multiplexed streams feature of HTTP/2, in which the client repeatedly makes a request for a new stream, and then immediately sends a RSTSTREAM frame to cancel them, resulting in the server doing lots of extra work to set up and tear down the streams, while not hitting any server-side limit on a maximum number of active streams per connection.
CVE-2023-44487 was issued to track this issue across implementations: https://www.cve.org/CVERecord?id=CVE-2023-44487
A script to check for affected implemenations has been posted at: https://github.com/bcdannyboy/CVE-2023-44487
Information I've found so far on open source implementations (most via the current listings in the CVE) include:
- Apache httpd: https://chaos.social/@icing/111210915918780532
- caddy: https://github.com/caddyserver/caddy/issues/5877
- envoy: https://github.com/envoyproxy/envoy/pull/30055
- golang: https://github.com/golang/go/issues/63417 https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
- h2o: https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf https://github.com/h2o/h2o/pull/3291
- haproxy: https://github.com/haproxy/haproxy/issues/2312
- hyper: https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
- jetty: https://github.com/eclipse/jetty.project/issues/10679 https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.2 https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.17 https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.17 https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
- netty: https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
- nghttp2: https://github.com/nghttp2/nghttp2/pull/1961 https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
- nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
- nodejs: https://github.com/nodejs/node/pull/50121
- proxygen: https://github.com/facebook/proxygen/pull/466
- swift-nio-http2: https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
- tomcat: https://tomcat.apache.org/security-11.html#FixedinApacheTomcat11.0.0-M12 https://tomcat.apache.org/security-10.html#FixedinApacheTomcat10.1.14 https://tomcat.apache.org/security-9.html#FixedinApacheTomcat9.0.81 https://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.94
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
End of life: 2/6/2024, Latest version: 1.20.14
End of life: 2/6/2024, Latest version: 1.20.14
End of life: 9/6/2023, Latest version: 1.19.13
End of life: 9/6/2023, Latest version: 1.19.13
Security Fix(es): golang: out-of-bounds read in golang.org/x/text/language leads to DoS (CVE-2021-38561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
End of life: 2/1/2023, Latest version: 1.18.10
End of life: 2/1/2023, Latest version: 1.18.10
End of life: 8/2/2022, Latest version: 1.17.13
End of life: 8/2/2022, Latest version: 1.17.13
End of life: 3/15/2022, Latest version: 1.16.15
End of life: 3/15/2022, Latest version: 1.16.15
End of life: 8/16/2021, Latest version: 1.15.15
End of life: 8/16/2021, Latest version: 1.15.15
End of life: 2/16/2021, Latest version: 1.14.15
End of life: 2/16/2021, Latest version: 1.14.15
End of life: 8/11/2020, Latest version: 1.13.15
End of life: 8/11/2020, Latest version: 1.13.15
End of life: 2/25/2020, Latest version: 1.12.17
End of life: 2/25/2020, Latest version: 1.12.17
End of life: 9/3/2019, Latest version: 1.11.13
End of life: 9/3/2019, Latest version: 1.11.13