Arbitrary Memory Allocation Vulnerability in golang
Summary
CVE-2023-45290: Memory exhaustion in multipart form parsing in net/textproto and net/http. Affects golang across 2 version ranges.
< 1.21.8
>= 1.22.0-0, < 1.22.1
Fixed in 1.21.8 or 1.22.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-45290 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a robust and efficient environment for developing applications. It offers a wide range of features and libraries to simplify the development process. However, a vulnerability has been discovered in the package that allows for arbitrary memory allocation, potentially leading to memory exhaustion.
Vulnerability Detail
The vulnerability arises when parsing a multipart form in golang. The package fails to apply limits on the total size of the parsed form to the memory consumed while reading a single form line. This allows an attacker to craft malicious input with very long lines, causing the allocation of large amounts of memory. As a result, the system may run out of memory, leading to denial of service or other security issues.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.21.81.21.8 -
>= 1.22.0-0, < 1.22.11.22.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the golang package to the fixed version as soon as possible.
Conclusion
The arbitrary memory allocation vulnerability in golang can have severe consequences, including denial of service and potential security breaches. It is crucial to update the golang package to version 1.22.1 or later to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows an attacker to exhaust the system's memory by sending specially crafted input. This can lead to denial of service or other security issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for potential vulnerabilities.
At the time of this report, there is no known exploit for this vulnerability. However, it is essential to update the golang package to the fixed version to mitigate any potential risks.
The only effective mitigation is to update the golang package to the fixed version. It is recommended to regularly update your packages to ensure you have the latest security patches.
While it is possible to manually limit memory allocation in your application, it is not a recommended solution for this vulnerability. The fix provided in the updated golang package ensures proper limits are applied during form parsing.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
