Skip to content

Commit 145e193

Browse files
committed
net/http: update bundled golang.org/x/net/http2 to import security fix
Update golang.org/x/net to v0.0.0-20190813141303-74dc4d7220e7 to import the following security fix. commit 74dc4d7220e7acc4e100824340f3e66577424772 Author: Filippo Valsorda <[email protected]> Date: Sun Aug 11 02:12:18 2019 -0400 http2: limit number of control frames in server send queue An attacker could cause servers to queue an unlimited number of PING ACKs or RST_STREAM frames by soliciting them and not reading them, until the program runs out of memory. Limit control frames in the queue to a few thousands (matching the limit imposed by other vendors) by counting as they enter and exit the scheduler, so the protection will work with any WriteScheduler. Once the limit is exceeded, close the connection, as we have no way to communicate with the peer. Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552 Reviewed-by: Brad Fitzpatrick <[email protected]> This change was generated with cmd/go and cmd/bundle: $ go get -u golang.org/x/net $ go mod tidy $ go mod vendor $ go generate net/http Fixes CVE-2019-9512 and CVE-2019-9514 Fixes #33606 Change-Id: I464baf96175006aa101d65d3b0f6494f28a626ab Reviewed-on: https://go-review.googlesource.com/c/go/+/190137 Reviewed-by: Dmitri Shuralyov <[email protected]>
1 parent 5498fa9 commit 145e193

12 files changed

+58
-22
lines changed

src/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.12
44

55
require (
66
golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8
7-
golang.org/x/net v0.0.0-20190607181551-461777fb6f67
7+
golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7
88
golang.org/x/sys v0.0.0-20190529130038-5219a1e1c5f8 // indirect
99
golang.org/x/text v0.3.2 // indirect
1010
)

src/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
22
golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8 h1:1wopBVtVdWnn03fZelqdXTqk7U7zPQCb+T4rbU9ZEoU=
33
golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
44
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
5-
golang.org/x/net v0.0.0-20190607181551-461777fb6f67 h1:rJJxsykSlULwd2P2+pg/rtnwN2FrWp4IuCxOSyS0V00=
6-
golang.org/x/net v0.0.0-20190607181551-461777fb6f67/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
5+
golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 h1:fHDIZ2oxGnUZRN6WgWFCbYBjH9uqVPRCUVUDhs0wnbA=
6+
golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
77
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
88
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
99
golang.org/x/sys v0.0.0-20190529130038-5219a1e1c5f8 h1:2WjIC11WRITGlVWmyLXKjzIVj1ZwoWZ//tadeUUV6/o=

src/net/http/h2_bundle.go

Lines changed: 46 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/lif/zsys_solaris_amd64.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/route/zsys_darwin.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/route/zsys_dragonfly.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/route/zsys_freebsd_386.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/route/zsys_freebsd_amd64.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/route/zsys_freebsd_arm.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/route/zsys_netbsd.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/golang.org/x/net/route/zsys_openbsd.go

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/vendor/modules.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ golang.org/x/crypto/hkdf
77
golang.org/x/crypto/internal/chacha20
88
golang.org/x/crypto/internal/subtle
99
golang.org/x/crypto/poly1305
10-
# golang.org/x/net v0.0.0-20190607181551-461777fb6f67
10+
# golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7
1111
golang.org/x/net/dns/dnsmessage
1212
golang.org/x/net/http/httpguts
1313
golang.org/x/net/http/httpproxy

0 commit comments

Comments
 (0)