Read the docs
TI-2022-20109 Aliases CVE-2022-41717GHSA-xrjj-mj9h-534m

Excessive memory growth in net/http and golang.org/x/net/http2

Priority LOW 33CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 35 fixed, 30 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

Why it matters now

EPSS 0.06077 93rd percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.18.9, 1.19.4golang.org/x/net/http2 (golang.org/x/net): 0.4.0+2 more productsRed Hat: 61 advisoriesRed Hat: 35 fixed, 30 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet/httpbefore 1.18.9; 1.19.0-0 to before 1.19.41.18.9, 1.19.4Patch availableCNA
Go standard librarygolang.org/x/net/http2before 0.4.00.4.0Patch availableCNA
—golang.org/x/net/http2 (Go)before 0.4.00.4.0Patch availableGHSA-xrjj-mj9h-534m
—golang.org/x/net (Go)before 0.4.00.4.0Patch availableGHSA-xrjj-mj9h-534m
  • net/http VendorGo standard library Affected before 1.18.9; 1.19.0-0 to before 1.19.4 Fixed in 1.18.9, 1.19.4 Patch available CNA
  • golang.org/x/net/http2 VendorGo standard library Affected before 0.4.0 Fixed in 0.4.0 Patch available CNA
  • golang.org/x/net/http2 (Go) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-xrjj-mj9h-534m
  • golang.org/x/net (Go) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-xrjj-mj9h-534m

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.18.9; 1.19.0 to before 1.19.4VulnerableGo standard library
cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*before 0.4.0VulnerableGo standard library
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.18.9; 1.19.0 to before 1.19.4 Vulnerable ·Go standard library
  • cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:* Versions before 0.4.0 Vulnerable ·Go standard library
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA net/http (Go standard library) Fixed in 1.18.9, 1.19.4
  • Fix · CNA golang.org/x/net/http2 (golang.org/x/net) Fixed in 0.4.0
  • Fix · GHSA-xrjj-mj9h-534m golang.org/x/net/http2 (Go) Fixed in 0.4.0 Advisory →
  • Fix · GHSA-xrjj-mj9h-534m golang.org/x/net (Go) Fixed in 0.4.0 Advisory →

Red Hat 61 advisories

  • RHSA-2024:0746 Released 2024-02-08 · Red Hat rating Important
    new container image: rhceph-5.3
    • Red Hat Ceph Storage 5.3 Tools rhceph/rhceph-5-dashboard-rhel8, rhceph/rhceph-haproxy-rhel8
  • RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
    Satellite 6.14 security and bug fix update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
  • RHSA-2023:6420 Released 2023-11-07 · Red Hat rating Moderate
    grafana security and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-7.el9_3
Show 58 more Red Hat advisories
  • RHSA-2023:5982 Released 2023-10-20 · Red Hat rating Important
    Red Hat Satellite Client security and bug fix update
    • Satellite Client 6 for RHEL 6 puppet-agent-7.26.0-3.el6sat
    • Satellite Client 6 for RHEL 7 foreman_ygg_worker-0.2.2-1.el7sat, puppet-agent-7.26.0-3.el7sat, yggdrasil-0.2.3-1.el7sat
    • Satellite Client 6 for RHEL 8 foreman_ygg_worker-0.2.2-1.el8sat, puppet-agent-7.26.0-3.el8sat, yggdrasil-0.2.3-1.el8sat
    • Satellite Client 6 for RHEL 9 foreman_ygg_worker-0.2.2-1.el9sat, puppet-agent-7.26.0-3.el9sat, yggdrasil-0.2.3-1.el9sat
  • RHSA-2023:4470 Released 2023-08-03 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.3 for RHEL 8 openshift-clients-4.12.0-202307200611.p0.g49844f7.assembly.stream.el8
  • RHSA-2023:4091 Released 2023-07-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.5 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-apiserver-network-proxy-rhel8, openshift4/ose-cluster-kube-cluster-api-rhel8-operator, openshift4/ose-kube-rbac-proxy +1
  • RHSA-2023:4090 Released 2023-07-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.5 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-nfd-operator, openshift4/ose-node-feature-discovery
  • RHSA-2023:3910 Released 2023-07-06 · Red Hat rating Important
    Red Hat OpenShift Enterprise security update
    • Red Hat OpenShift Container Platform 4.10 containers-common-1:1.2.4-1.1.el8, openshift-4.10.0-202306170106.p0.g16bcd69.assembly.stream.el7, openshift-4.10.0-202306170106.p0.g16bcd69.assembly.stream.el8 +10
  • RHSA-2023:3914 Released 2023-07-06 · Red Hat rating Important
    Red Hat OpenShift Enterprise security update
    • Red Hat OpenShift Container Platform 4.11 buildah-1:1.23.4-3.rhaos4.11.el8, buildah-tests-1:1.23.4-3.rhaos4.11.el8, openshift-4.11.0-202306260054.p0.g990d55b.assembly.stream.el8 +12
  • RHSA-2023:3612 Released 2023-06-23 · Red Hat rating Important
    OpenShift Container Platform 4.13.4 packages and security update
    • Red Hat OpenShift Container Platform 4.13 bpftool-7.0.0-284.18.1.el9_2, buildah-1:1.29.1-2.1.rhaos4.13.el9, buildah-1:1.29.1-2.rhaos4.13.el8 +47
  • RHSA-2023:3742 Released 2023-06-21 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
    • RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
  • RHSA-2023:0584 Released 2023-05-18 · Red Hat rating Moderate
    Secondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update
    • OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
  • RHSA-2023:3205 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
    • CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
  • RHSA-2023:1329 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 microshift-4.13.0-202305161335.p0.g17cae44.assembly.4.13.0.el9, microshift-greenboot-4.13.0-202305161335.p0.g17cae44.assembly.4.13.0.el9, microshift-networking-4.13.0-202305161335.p0.g17cae44.assembly.4.13.0.el9 +2
  • RHSA-2023:3204 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Virtualization 4.13.0 RPMs security and bug fix update
    • CNV 4.13 for RHEL 7 kubevirt-4.13.0-1469.el7, kubevirt-virtctl-4.13.0-1469.el7, kubevirt-virtctl-redistributable-4.13.0-1469.el7
    • CNV 4.13 for RHEL 8 kubevirt-4.13.0-1469.el8, kubevirt-virtctl-4.13.0-1469.el8, kubevirt-virtctl-redistributable-4.13.0-1469.el8
    • CNV 4.13 for RHEL 9 kubevirt-4.13.0-1469.el9, kubevirt-virtctl-4.13.0-1469.el9, kubevirt-virtctl-redistributable-4.13.0-1469.el9
  • RHSA-2023:1328 Released 2023-05-18 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/dpu-network-rhel8-operator, openshift4/metallb-rhel8-operator, openshift4/ose-aws-efs-csi-driver-container-rhel8 +17
  • RHSA-2023:1325 Released 2023-05-18 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.13 python-werkzeug-2.0.3-4.el9, python3-werkzeug-2.0.3-4.el9
    • Red Hat OpenShift Container Platform 4.13 buildah-1:1.29.1-1.rhaos4.13.el9, buildah-tests-1:1.29.1-1.rhaos4.13.el9, cri-o-1.26.3-3.rhaos4.13.git641290e.el9 +27
  • RHSA-2023:1326 Released 2023-05-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2023:1327 Released 2023-05-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-capacity
  • RHSA-2023:2802 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-37.module+el8.8.0+17954+9046de88.s390x::container-tools:4.0 +47
  • RHSA-2023:2780 Released 2023-05-16 · Red Hat rating Moderate
    Image Builder security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-75-1.el8, osbuild-composer-core-75-1.el8, osbuild-composer-dnf-json-75-1.el8 +2
  • RHSA-2023:2758 Released 2023-05-16 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+18060+3f21f2cc.s390x::container-tools:rhel8 +47
  • RHSA-2023:2866 Released 2023-05-16 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) git-lfs-3.2.0-2.el8
  • RHSA-2023:2728 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat OpenShift Distributed Tracing 2.8.0 security update
    • Red Hat OpenShift distributed tracing 2.8 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +11
  • RHSA-2023:1372 Released 2023-05-10 · Red Hat rating Moderate
    Red Hat OpenShift support for Windows Containers 8.0.0 [security update]
    • Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-rhel9-operator
  • RHSA-2023:2204 Released 2023-05-09 · Red Hat rating Moderate
    Image Builder security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-76-2.el9_2, osbuild-composer-core-76-2.el9_2, osbuild-composer-dnf-json-76-2.el9_2 +2
  • RHSA-2023:2222 Released 2023-05-09 · Red Hat rating Moderate
    conmon security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) conmon-2:2.1.7-1.el9_2
  • RHSA-2023:2236 Released 2023-05-09 · Red Hat rating Moderate
    toolbox security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.3-9.el9, toolbox-tests-0.0.99.3-9.el9
  • RHSA-2023:2357 Released 2023-05-09 · Red Hat rating Moderate
    git-lfs security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.2.0-1.el9
  • RHSA-2023:2283 Released 2023-05-09 · Red Hat rating Moderate
    skopeo security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.11.2-0.1.el9, skopeo-tests-2:1.11.2-0.1.el9
  • RHSA-2023:2282 Released 2023-05-09 · Red Hat rating Moderate
    podman security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.4.1-3.el9, podman-docker-2:4.4.1-3.el9, podman-gvproxy-2:4.4.1-3.el9 +3
  • RHSA-2023:2253 Released 2023-05-09 · Red Hat rating Moderate
    buildah security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.29.1-1.el9, buildah-tests-1:1.29.1-1.el9
  • RHSA-2023:2367 Released 2023-05-09 · Red Hat rating Moderate
    containernetworking-plugins security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.2.0-1.el9
  • RHSA-2023:1817 Released 2023-04-18 · Red Hat rating Moderate
    Network observability 1.2.0 for Openshift
    • NETOBSERV 1.2 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +1
  • RHSA-2023:1816 Released 2023-04-17 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.12.2 Bug Fix and security update
    • RHODF 4.12 for RHEL 8 odf4/odf-multicluster-rhel8-operator
  • RHSA-2023:1529 Released 2023-03-30 · Red Hat rating Moderate
    Service Telemetry Framework 1.5 security update
    • Service Telemetry Framework 1.5 for RHEL 8 stf/sg-core-rhel8
  • RHSA-2023:1310 Released 2023-03-29 · Red Hat rating Moderate
    Logging Subsystem for Red Hat OpenShift - 5.5.9 security update
    • RHOL 5.5 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator
  • RHSA-2023:1448 Released 2023-03-23 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.3.2 security update
    • RHOSSM 2.3 for RHEL 8 openshift-service-mesh/kiali-rhel8
  • RHSA-2023:1268 Released 2023-03-21 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.8 security update
    • Red Hat OpenShift Container Platform 4.12 haproxy-2.2.24-3.rhaos4.12.el8, haproxy22-2.2.24-3.rhaos4.12.el8, openshift-4.12.0-202303132316.p0.geab9cc9.assembly.stream.el8 +3
  • RHSA-2023:1154 Released 2023-03-16 · Red Hat rating Important
    OpenShift Container Platform 4.10.54 security update
    • Red Hat OpenShift Container Platform 4.10 openshift4/ose-csi-driver-manila-rhel8-operator, openshift4/ose-machine-config-operator
  • RHSA-2023:1276 Released 2023-03-15 · Red Hat rating Moderate
    Red Hat OpenStack Platform (collectd-libpod-stats) security update
    • Red Hat OpenStack Platform 16.1 collectd-libpod-stats-1.0.4-3.el8ost
    • Red Hat OpenStack Platform 16.2 collectd-libpod-stats-1.0.4-3.el8ost
  • RHSA-2023:1275 Released 2023-03-15 · Red Hat rating Important
    Red Hat OpenStack Platform (etcd) security update
    • Red Hat OpenStack Platform 16.1 etcd-3.3.23-12.el8ost
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-12.el8ost
  • RHSA-2023:1181 Released 2023-03-09 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.27.1
    • Red Hat OpenShift Serverless 1.27 openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8 +33
  • RHSA-2023:1179 Released 2023-03-09 · Red Hat rating Moderate
    Release of OpenShift Serverless Client kn 1.27.1
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.6.1-2.el8
  • RHSA-2023:1174 Released 2023-03-09 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.1.2 security and bug fix update
    • 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-mustgather-rhel8, oadp/oadp-rhel8-operator +8
  • RHSA-2023:0931 Released 2023-03-08 · Red Hat rating Moderate
    Logging Subsystem 5.4.12 - Red Hat OpenShift
    • RHOL 5.4 for RHEL 8 openshift-logging/eventrouter-rhel8
  • RHSA-2023:0930 Released 2023-03-08 · Red Hat rating Moderate
    Logging Subsystem 5.5.8 - Red Hat OpenShift
    • RHOL 5.5 for RHEL 8 openshift-logging/elasticsearch-rhel8-operator, openshift-logging/eventrouter-rhel8, openshift-logging/logging-loki-rhel8 +1
  • RHSA-2023:0932 Released 2023-03-08 · Red Hat rating Moderate
    Logging Subsystem 5.6.3 - Red Hat OpenShift
    • RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/eventrouter-rhel8, openshift-logging/logging-view-plugin-rhel8
  • RHSA-2023:1030 Released 2023-03-07 · Red Hat rating Moderate
    OpenShift Container Platform 4.11.30 security update
    • Red Hat OpenShift Container Platform 4.11 openshift4/ose-csi-driver-manila-rhel8-operator
  • RHSA-2023:1079 Released 2023-03-06 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2 (osp-director-downloader-container, osp-director-agent-container and osp-director-operator-container) security update
    • Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
  • RHSA-2023:0899 Released 2023-03-01 · Red Hat rating Important
    OpenShift Container Platform 4.10.53 bug fix and security update
    • Red Hat OpenShift Container Platform 4.10 openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer, openshift4/ose-openstack-machine-controllers +1
  • RHSA-2023:0934 Released 2023-02-28 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 6.0 for RHEL 8 mta/mta-admin-addon-rhel8, mta/mta-hub-rhel8, mta/mta-ui-rhel8 +1
  • RHSA-2023:0918 Released 2023-02-27 · Red Hat rating Moderate
    Service Binding Operator security update
    • OpenShift Developer Tools and Services for OCP 4.9 for RHEL 8 ocp-tools-4/service-binding-operator-bundle, ocp-tools-4/service-binding-rhel8-operator
  • RHSA-2023:0774 Released 2023-02-21 · Red Hat rating Important
    OpenShift Container Platform 4.11.28 security update
    • Red Hat OpenShift Container Platform 4.11 openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer, openshift4/ose-installer-artifacts +1
  • RHSA-2023:0769 Released 2023-02-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.4 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-csi-driver-manila-rhel8-operator, openshift4/ose-csi-driver-nfs-rhel8, openshift4/ose-machine-api-provider-openstack-rhel8
  • RHSA-2023:0728 Released 2023-02-16 · Red Hat rating Important
    OpenShift Container Platform 4.12.3 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cluster-etcd-rhel8-operator, openshift4/ose-csi-driver-manila-rhel8, openshift4/ose-installer
  • RHSA-2023:0632 Released 2023-02-15 · Red Hat rating Moderate
    Red Hat OpenShift (Logging Subsystem) security update
    • RHOL 5.4 for RHEL 8 openshift-logging/fluentd-rhel8, openshift-logging/lokistack-gateway-rhel8
  • RHSA-2023:0693 Released 2023-02-09 · Red Hat rating Moderate
    Migration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
  • RHSA-2023:0692 Released 2023-02-09 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.0.7 security and bug fix update
    • 8Base-OADP-1.0 oadp/oadp-registry-rhel8, oadp/oadp-velero-rhel8
  • RHSA-2023:0446 Released 2023-01-25 · Red Hat rating Moderate
    go-toolset:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.src::go-toolset:rhel8, delve-1.8.3-1.module+el8.7.0+15126+0e0a42d9.x86_64::go-toolset:rhel8, go-toolset-1.18.9-1.module+el8.7.0+17845+708ebe87.aarch64::go-toolset:rhel8 +18
  • RHSA-2023:0328 Released 2023-01-23 · Red Hat rating Moderate
    go-toolset and golang security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) golang-1.18.9-1.el9_1, golang-bin-1.18.9-1.el9_1, golang-docs-1.18.9-1.el9_1 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Application Interconnect 1.0AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenStack Platform 17.0AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Web TerminalAffectedNo fix yet: Fix deferred
Self Node Remediation OperatorAffectedNo fix yet
Service Telemetry Framework 1.3 for RHEL 8AffectedNo fix planned: Will not fix
Service Telemetry Framework 1.4 for RHEL 8AffectedNo fix planned: Will not fix
cert-manager Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
8Base-OADP-1.0Fixed RHSA-2023:0692
8Base-OADP-1.1Fixed RHSA-2023:1174
8Base-RHMTC-1.7Fixed RHSA-2023:0693
CNV 4.11 for RHEL 8Fixed—
CNV 4.13 for RHEL 7Fixed RHSA-2023:3204
CNV 4.13 for RHEL 8Fixed RHSA-2023:3204
CNV 4.13 for RHEL 9Fixed RHSA-2023:3204, RHSA-2023:3205
MTA 6.0 for RHEL 8Fixed RHSA-2023:0934
NETOBSERV 1.2 for RHEL 9Fixed RHSA-2023:1817
OSSO 1.1 for RHEL 8Fixed RHSA-2023:0584
OpenShift Developer Tools and Services for OCP 4.9 for RHEL 8Fixed RHSA-2023:0918
Quay v3Fixed—
RHODF 4.12 for RHEL 8Fixed RHSA-2023:1816
RHODF 4.13 for RHEL 9Fixed RHSA-2023:3742
RHOL 5.4 for RHEL 8Fixed RHSA-2023:0632, RHSA-2023:0931
RHOL 5.5 for RHEL 8Fixed RHSA-2023:0930, RHSA-2023:1310
RHOL 5.6 for RHEL 8Fixed RHSA-2023:0932
RHOSSM 2.3 for RHEL 8Fixed RHSA-2023:1448
Red Hat Ansible Automation Platform 2.3 for RHEL 8Fixed RHSA-2023:4470
Red Hat Ceph Storage 5.3 ToolsFixed RHSA-2024:0746
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:0446, RHSA-2023:2758, RHSA-2023:2780, RHSA-2023:2802, RHSA-2023:2866
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:0328, RHSA-2023:2204, RHSA-2023:2222, RHSA-2023:2236, RHSA-2023:2253, RHSA-2023:2282, RHSA-2023:2283, RHSA-2023:2357, RHSA-2023:2367, RHSA-2023:6420
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2023:0899, RHSA-2023:1154, RHSA-2023:3910
Red Hat OpenShift Container Platform 4.11Fixed RHSA-2023:0774, RHSA-2023:1030, RHSA-2023:3914
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2023:0728, RHSA-2023:0769, RHSA-2023:1268
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:1325, RHSA-2023:1326, RHSA-2023:1327, RHSA-2023:1328, RHSA-2023:1329, RHSA-2023:1372, RHSA-2023:3612, RHSA-2023:4090, RHSA-2023:4091
Red Hat OpenShift Serverless 1.0Fixed RHSA-2023:1179
Red Hat OpenShift Serverless 1.27Fixed RHSA-2023:1181
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:1275, RHSA-2023:1276
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:1079, RHSA-2023:1275, RHSA-2023:1276
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2023:6818
Satellite Client 6 for RHEL 7Fixed RHSA-2023:5982
Satellite Client 6 for RHEL 8Fixed RHSA-2023:5982
Satellite Client 6 for RHEL 9Fixed RHSA-2023:5982
Service Telemetry Framework 1.5 for RHEL 8Fixed RHSA-2023:1529
Not affected: 38 products
  • 8Base-OADP-1.0
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • Cryostat 2
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Logging Subsystem for Red Hat OpenShift
  • MTA 6.0 for RHEL 8
  • NETOBSERV 1.2 for RHEL 9
  • OSSO 1.1 for RHEL 8
  • RHODF 4.12 for RHEL 8
  • RHODF 4.13 for RHEL 9
  • RHOL 5.4 for RHEL 8
  • RHOL 5.5 for RHEL 8
  • RHOL 5.6 for RHEL 8
  • RHOSSM 2.3 for RHEL 8
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ceph Storage 5
  • Red Hat Ceph Storage 5.3 Tools
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 8)
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.11
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift on AWS
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6.14 for RHEL 8
  • Satellite Client 6 for RHEL 6
  • Satellite Client 6 for RHEL 7
  • Satellite Client 6 for RHEL 8
  • Satellite Client 6 for RHEL 9
  • Service Telemetry Framework 1.5 for RHEL 8
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41717
  2. 2026-10-03 Alias added: GHSA-xrjj-mj9h-534m

References

Patch 3

Advisory 3

Other 36

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences