📦 Vulnerable Dependencies

✍️ Summary

SEVERITY	DIRECT DEPENDENCIES	IMPACTED DEPENDENCY	FIXED VERSIONS
High	github.com/grokify/mogo:v0.40.4 github.com/jfrog/froggit-go:v1.3.1 golang.org/x/net:v0.0.0-20220812174116-3211cb980234	golang.org/x/net:v0.0.0-20220812174116-3211cb980234	[0.1.1-0.20221104162952-702349b0e862]

👇 Details

• Severity 🔥 High
• Package Name: golang.org/x/net
• Current Version: v0.0.0-20220812174116-3211cb980234
• Fixed Version: [0.1.1-0.20221104162952-702349b0e862]
• CVE: CVE-2022-41721

Description:

Go's h2c package implements the h2c protocol non-TLS version of HTTP/2.

HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web. It was derived from the earlier experimental SPDY protocol, originally developed by Google.

A client starts an HTTP/1.1 connection and sends an Upgrade: h2c header. If the server supports HTTP/2, it replies with HTTP 101 Switching Protocol status code.

The h2c package handled this request by handing off the request to the HTTP/2 server.

It was discovered that when the request body is not fully-read, the partially-read request would be handed-off to the HTTP/2 server. This could result in a request smuggling attack, where a request can be treated by a server as 2 separate requests, giving an attacker the ability to create arbitrary requests.

Note that the issue only occurs when limiting the size of the initial HTTP/1.1 request body with a MaxBytesHandler.