CVE-2024-45338

Non-linear parsing of case-insensitive content in golang.org/x/net/html

Published Dec 18, 2024 CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Description
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-3617 An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Github GHSA Github GHSA GHSA-w32m-9786-jp63 Non-linear parsing of case-insensitive content in golang.org/x/net/html
Ubuntu USN Ubuntu USN USN-7197-1 Go Networking vulnerability
Ubuntu USN Ubuntu USN USN-8900-1 Go Networking vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00182}

epss

{'score': 0.00149}

Type Values Removed Values Added
Metrics epss

{'score': 0.00159}

epss

{'score': 0.00182}

Type Values Removed Values Added
First Time appeared Redhat openshift Api Data Protection
Redhat windows Machine Config
CPEs cpe:/a:redhat:openshift_api_data_protection:1.3::el9
cpe:/a:redhat:windows_machine_config:10.16::el9
Vendors & Products Redhat openshift Api Data Protection
Redhat windows Machine Config
Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:7.1::el9
Vendors & Products Redhat ceph Storage
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt
Type Values Removed Values Added
CPEs cpe:/a:redhat:logging:5.8::el9
cpe:/a:redhat:logging:5.9::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:container_native_virtualization:4.16::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhdh:1.5::el9
Type Values Removed Values Added
First Time appeared Redhat logging
CPEs cpe:/a:redhat:logging:6.0::el9
cpe:/a:redhat:logging:6.1::el9
Vendors & Products Redhat logging
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhdh:1.3::el9
Type Values Removed Values Added
First Time appeared Redhat openshift Gitops
CPEs cpe:/a:redhat:openshift:4.14::el9
cpe:/a:redhat:openshift_gitops:1.14::el8
Vendors & Products Redhat openshift Gitops
Type Values Removed Values Added
First Time appeared Redhat openshift Pipelines
CPEs cpe:/a:redhat:openshift_pipelines:1.18::el9
Vendors & Products Redhat openshift Pipelines
Type Values Removed Values Added
CPEs cpe:/a:redhat:container_native_virtualization:4.15::el9
cpe:/a:redhat:openshift_ai:2.18::el8
cpe:/a:redhat:openshift_data_foundation:4.18::el9
Type Values Removed Values Added
First Time appeared Redhat insights Runtimes Operator
CPEs cpe:/a:redhat:insights_runtimes_operator:1.0::el8
Vendors & Products Redhat insights Runtimes Operator
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.14::el9
cpe:/a:redhat:openshift_data_foundation:4.15::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:container_native_virtualization:4.18::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.18::el9
Type Values Removed Values Added
First Time appeared Redhat cluster Observability Operator
CPEs cpe:/a:redhat:cluster_observability_operator:1.0::el8
Vendors & Products Redhat cluster Observability Operator
Type Values Removed Values Added
First Time appeared Redhat rhdh
CPEs cpe:/a:redhat:advanced_cluster_security:4.4::el8
cpe:/a:redhat:openshift:4.13::el8
cpe:/a:redhat:openshift_ai:2.17::el8
cpe:/a:redhat:rhdh:1.4::el9
Vendors & Products Redhat rhdh
Type Values Removed Values Added
First Time appeared Redhat gatekeeper
CPEs cpe:/a:redhat:gatekeeper:3.14::el9
cpe:/a:redhat:gatekeeper:3.15::el9
cpe:/a:redhat:gatekeeper:3.17::el9
Vendors & Products Redhat gatekeeper
Type Values Removed Values Added
First Time appeared Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat cert Manager
Redhat container Native Virtualization
Redhat cryostat
Redhat multicluster Engine
Redhat multicluster Globalhub
Redhat openshift
Redhat openshift Ai
Redhat openshift Builds
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat openshift Distributed Tracing
Redhat service Mesh
Redhat trusted Artifact Signer
Redhat trusted Profile Analyzer
CPEs cpe:/a:redhat:acm:2.10::el9
cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.12::el9
cpe:/a:redhat:acm:2.9::el8
cpe:/a:redhat:advanced_cluster_security:4.5::el8
cpe:/a:redhat:advanced_cluster_security:4.6::el8
cpe:/a:redhat:cert_manager:1.15::el9
cpe:/a:redhat:container_native_virtualization:4.17::el9
cpe:/a:redhat:cryostat:3::el8
cpe:/a:redhat:multicluster_engine:2.4::el8
cpe:/a:redhat:multicluster_engine:2.6::el8
cpe:/a:redhat:multicluster_engine:2.6::el9
cpe:/a:redhat:multicluster_globalhub:1.2::el9
cpe:/a:redhat:multicluster_globalhub:1.3::el9
cpe:/a:redhat:openshift:4.12::el8
cpe:/a:redhat:openshift:4.14::el8
cpe:/a:redhat:openshift:4.15::el8
cpe:/a:redhat:openshift:4.15::el9
cpe:/a:redhat:openshift:4.16::el9
cpe:/a:redhat:openshift:4.17::el9
cpe:/a:redhat:openshift_ai:2.16::el8
cpe:/a:redhat:openshift_builds:1.1::el9
cpe:/a:redhat:openshift_builds:1.2::el9
cpe:/a:redhat:openshift_data_foundation:4.16::el9
cpe:/a:redhat:openshift_data_foundation:4.17::el9
cpe:/a:redhat:openshift_devspaces:3::el9
cpe:/a:redhat:openshift_distributed_tracing:3.4::el8
cpe:/a:redhat:service_mesh:2.4::el8
cpe:/a:redhat:service_mesh:2.5::el8
cpe:/a:redhat:service_mesh:2.6::el9
cpe:/a:redhat:trusted_artifact_signer:1.1::el9
cpe:/a:redhat:trusted_profile_analyzer:1.2::el9
Vendors & Products Redhat
Redhat acm
Redhat advanced Cluster Security
Redhat cert Manager
Redhat container Native Virtualization
Redhat cryostat
Redhat multicluster Engine
Redhat multicluster Globalhub
Redhat openshift
Redhat openshift Ai
Redhat openshift Builds
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat openshift Distributed Tracing
Redhat service Mesh
Redhat trusted Artifact Signer
Redhat trusted Profile Analyzer
Type Values Removed Values Added
Weaknesses CWE-1333
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Type Values Removed Values Added
Description An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
Title Non-linear parsing of case-insensitive content in golang.org/x/net/html
References