CVE-2017-1000098 — DEPRECATED: Uncontrolled File Descriptor Consumption in GO

CWE-769 — DEPRECATED: Uncontrolled File Descriptor Consumption9 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 37.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Golang GO
Timeline
PublishedOct 5
Latest updateMay 14

Description

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDgolang/go1.7 — 1.7.4+1

Patches

Patch: golang.org ↗Patch: golang.org ↗Patch: golang.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-fw93-hqg3-9vw4: The net/http package's Request↗2022-05-14
▶
OSV
Denial of service when parsing large forms in mime/multipart↗2022-02-15
▶
OSV
CVE-2017-1000098: The net/http package's Request↗2017-10-05
▶
CVEList
CVE-2017-1000098: The net/http package's Request↗2017-10-04
▶

📋Vendor Advisories

1
Red Hat
golang: net/http: multipart ReadForm close file after copy↗2016-12-01
▶

💬Community

3
Bugzilla
CVE-2017-1000098 golang: net/http: multipart ReadForm close file after copy [epel-all]↗2016-12-06
▶
Bugzilla
CVE-2017-1000098 golang: net/http: multipart ReadForm close file after copy↗2016-12-06
▶
Bugzilla
CVE-2017-1000098 golang: net/http: multipart ReadForm close file after copy [fedora-all]↗2016-12-06
▶
CVE-2017-1000098 — Golang GO vulnerability | cvebase