VDB
RHSA-2024%3A3617
RHSA-2024%3A3617
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A flaw was discovered in Go's net/http standard library package. When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:e60edf5aa0893cba72988c09ae340619accd37a7b171e2af873de37c44f449ac_ppc64le as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:e60edf5aa0893cba72988c09ae340619accd37a7b171e2af873de37c44f449ac_ppc64le, * |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:62da135a18b602beeef94dcf035d637b149206d017c83d7d630c5001795e1df0_s390x as a component of KDO 5.0 for RHEL 9 | *, *, * |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:0164ab8191aef77765861c677ab8c62ea648468e5be8283652b8200688e9cf35_arm64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:0164ab8191aef77765861c677ab8c62ea648468e5be8283652b8200688e9cf35_arm64, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:0164ab8191aef77765861c677ab8c62ea648468e5be8283652b8200688e9cf35_arm64, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:0164ab8191aef77765861c677ab8c62ea648468e5be8283652b8200688e9cf35_arm64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:442e22a6292d7696a69d650f7e2f3873a3c3b947f70ccf16b97b70a2f6a7c9b8_s390x as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:442e22a6292d7696a69d650f7e2f3873a3c3b947f70ccf16b97b70a2f6a7c9b8_s390x, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:442e22a6292d7696a69d650f7e2f3873a3c3b947f70ccf16b97b70a2f6a7c9b8_s390x, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:442e22a6292d7696a69d650f7e2f3873a3c3b947f70ccf16b97b70a2f6a7c9b8_s390x |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:e4806d2fb547a29e2d33c8c6b2dd7ba2d0c3f23074384884b488077a19aa0bab_arm64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:e4806d2fb547a29e2d33c8c6b2dd7ba2d0c3f23074384884b488077a19aa0bab_arm64, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:e4806d2fb547a29e2d33c8c6b2dd7ba2d0c3f23074384884b488077a19aa0bab_arm64, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:e4806d2fb547a29e2d33c8c6b2dd7ba2d0c3f23074384884b488077a19aa0bab_arm64 |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:587190a7b65ea56ce257ae486c0faa6616290fa39f81431359dc2b2d78521b4b_amd64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:587190a7b65ea56ce257ae486c0faa6616290fa39f81431359dc2b2d78521b4b_amd64, kube-descheduler-operator/descheduler-rhel9@sha256:587190a7b65ea56ce257ae486c0faa6616290fa39f81431359dc2b2d78521b4b_amd64, kube-descheduler-operator/descheduler-rhel9@sha256:587190a7b65ea56ce257ae486c0faa6616290fa39f81431359dc2b2d78521b4b_amd64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:5041af3cc040d3e550599e6436bfddd1f449338bb54705273afbc8c4a0dde360_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:5041af3cc040d3e550599e6436bfddd1f449338bb54705273afbc8c4a0dde360_ppc64le, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:5041af3cc040d3e550599e6436bfddd1f449338bb54705273afbc8c4a0dde360_ppc64le, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:5041af3cc040d3e550599e6436bfddd1f449338bb54705273afbc8c4a0dde360_ppc64le |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:442e22a6292d7696a69d650f7e2f3873a3c3b947f70ccf16b97b70a2f6a7c9b8_s390x as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:442e22a6292d7696a69d650f7e2f3873a3c3b947f70ccf16b97b70a2f6a7c9b8_s390x, *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:442e22a6292d7696a69d650f7e2f3873a3c3b947f70ccf16b97b70a2f6a7c9b8_s390x |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:941359511dc5c78eada7f13f5800cb831bb00924e8007adf93201371f522ab6f_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:941359511dc5c78eada7f13f5800cb831bb00924e8007adf93201371f522ab6f_ppc64le, kube-descheduler-operator/descheduler-rhel9@sha256:941359511dc5c78eada7f13f5800cb831bb00924e8007adf93201371f522ab6f_ppc64le, kube-descheduler-operator/descheduler-rhel9@sha256:941359511dc5c78eada7f13f5800cb831bb00924e8007adf93201371f522ab6f_ppc64le |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:e60edf5aa0893cba72988c09ae340619accd37a7b171e2af873de37c44f449ac_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:e60edf5aa0893cba72988c09ae340619accd37a7b171e2af873de37c44f449ac_ppc64le, *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:e60edf5aa0893cba72988c09ae340619accd37a7b171e2af873de37c44f449ac_ppc64le |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:664515e8e38df2bb2cb751e8c0870a1bcbbaf46e4feca86002b225c98610a40d_arm64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:664515e8e38df2bb2cb751e8c0870a1bcbbaf46e4feca86002b225c98610a40d_arm64, *, * |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:0164ab8191aef77765861c677ab8c62ea648468e5be8283652b8200688e9cf35_arm64 as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:0164ab8191aef77765861c677ab8c62ea648468e5be8283652b8200688e9cf35_arm64, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:0164ab8191aef77765861c677ab8c62ea648468e5be8283652b8200688e9cf35_arm64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:93cca62bc492bb590667231b26eb5dd0b2c03d866e3035729029ad4bd7a2d351_amd64 as a component of KDO 5.0 for RHEL 9 | *, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:93cca62bc492bb590667231b26eb5dd0b2c03d866e3035729029ad4bd7a2d351_amd64, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:93cca62bc492bb590667231b26eb5dd0b2c03d866e3035729029ad4bd7a2d351_amd64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:93cca62bc492bb590667231b26eb5dd0b2c03d866e3035729029ad4bd7a2d351_amd64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:93cca62bc492bb590667231b26eb5dd0b2c03d866e3035729029ad4bd7a2d351_amd64, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:93cca62bc492bb590667231b26eb5dd0b2c03d866e3035729029ad4bd7a2d351_amd64, kube-descheduler-operator/kube-descheduler-rhel9-operator@sha256:93cca62bc492bb590667231b26eb5dd0b2c03d866e3035729029ad4bd7a2d351_amd64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:b26e5ebec8ffcfaf18c8c4acb8c25a71318ea7d3b372c9e3e170b6026a681a89_amd64 as a component of KDO 5.0 for RHEL 9 | *, *, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:b26e5ebec8ffcfaf18c8c4acb8c25a71318ea7d3b372c9e3e170b6026a681a89_amd64 |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ef62663d2e7fd44ea7705fc60471bfe504522c22e565fb975617eb0f03a2e821_s390x as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ef62663d2e7fd44ea7705fc60471bfe504522c22e565fb975617eb0f03a2e821_s390x, *, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:ef62663d2e7fd44ea7705fc60471bfe504522c22e565fb975617eb0f03a2e821_s390x |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:664515e8e38df2bb2cb751e8c0870a1bcbbaf46e4feca86002b225c98610a40d_arm64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:664515e8e38df2bb2cb751e8c0870a1bcbbaf46e4feca86002b225c98610a40d_arm64, kube-descheduler-operator/descheduler-rhel9@sha256:664515e8e38df2bb2cb751e8c0870a1bcbbaf46e4feca86002b225c98610a40d_arm64, kube-descheduler-operator/descheduler-rhel9@sha256:664515e8e38df2bb2cb751e8c0870a1bcbbaf46e4feca86002b225c98610a40d_arm64 |
| Red Hat | kube-descheduler-operator/descheduler-rhel9@sha256:941359511dc5c78eada7f13f5800cb831bb00924e8007adf93201371f522ab6f_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/descheduler-rhel9@sha256:941359511dc5c78eada7f13f5800cb831bb00924e8007adf93201371f522ab6f_ppc64le, *, * |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:5041af3cc040d3e550599e6436bfddd1f449338bb54705273afbc8c4a0dde360_ppc64le as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:5041af3cc040d3e550599e6436bfddd1f449338bb54705273afbc8c4a0dde360_ppc64le, *, * |
| Red Hat | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:e4806d2fb547a29e2d33c8c6b2dd7ba2d0c3f23074384884b488077a19aa0bab_arm64 as a component of KDO 5.0 for RHEL 9 | kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:e4806d2fb547a29e2d33c8c6b2dd7ba2d0c3f23074384884b488077a19aa0bab_arm64, *, kube-descheduler-operator/kube-descheduler-operator-bundle@sha256:e4806d2fb547a29e2d33c8c6b2dd7ba2d0c3f23074384884b488077a19aa0bab_arm64 |
…and 4 more
Timeline
- Jul 1, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 16, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2024:3617 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268017 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268019 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268021 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268022 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2268046 issue
- https://issues.redhat.com/browse/WRKLDS-1059 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3617.json advisory
- https://access.redhat.com/security/cve/CVE-2023-45290 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-45290 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-45290 advisory
- http://www.openwall.com/lists/oss-security/2024/03/08/4 advisory
- https://go.dev/cl/569341 advisory
- https://go.dev/issue/65383 advisory
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg advisory
- https://pkg.go.dev/vuln/GO-2024-2599 advisory
- https://security.netapp.com/advisory/ntap-20240329-0004 advisory
- https://access.redhat.com/security/cve/CVE-2024-24783 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-24783 advisory
…and 21 more