diff options
| author | Filippo Valsorda <filippo@golang.org> | 2019-08-13 16:29:01 -0400 |
|---|---|---|
| committer | Filippo Valsorda <filippo@golang.org> | 2019-08-23 17:03:17 +0000 |
| commit | 145e193131eb486077b66009beb051aba07c52a5 (patch) | |
| tree | e940b8fa28c6974cb2fbece778dbfafc0620b20a /src/go.mod | |
| parent | 5498fa90e9921193be11c6e6a9e017a53c0e1588 (diff) | |
| download | go-145e193131eb486077b66009beb051aba07c52a5.tar.gz go-145e193131eb486077b66009beb051aba07c52a5.zip | |
net/http: update bundled golang.org/x/net/http2 to import security fix
Update golang.org/x/net to v0.0.0-20190813141303-74dc4d7220e7 to import
the following security fix.
commit 74dc4d7220e7acc4e100824340f3e66577424772
Author: Filippo Valsorda <filippo@golang.org>
Date: Sun Aug 11 02:12:18 2019 -0400
http2: limit number of control frames in server send queue
An attacker could cause servers to queue an unlimited number of PING
ACKs or RST_STREAM frames by soliciting them and not reading them, until
the program runs out of memory.
Limit control frames in the queue to a few thousands (matching the limit
imposed by other vendors) by counting as they enter and exit the scheduler,
so the protection will work with any WriteScheduler.
Once the limit is exceeded, close the connection, as we have no way to
communicate with the peer.
Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
Reviewed-by: Brad Fitzpatrick <bradfitz@google.com>
This change was generated with cmd/go and cmd/bundle:
$ go get -u golang.org/x/net
$ go mod tidy
$ go mod vendor
$ go generate net/http
Fixes CVE-2019-9512 and CVE-2019-9514
Fixes #33606
Change-Id: I464baf96175006aa101d65d3b0f6494f28a626ab
Reviewed-on: https://go-review.googlesource.com/c/go/+/190137
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Diffstat (limited to 'src/go.mod')
| -rw-r--r-- | src/go.mod | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/go.mod b/src/go.mod index 0d7d70f014..90af2a7ea0 100644 --- a/src/go.mod +++ b/src/go.mod @@ -4,7 +4,7 @@ go 1.12 require ( golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8 - golang.org/x/net v0.0.0-20190607181551-461777fb6f67 + golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7 golang.org/x/sys v0.0.0-20190529130038-5219a1e1c5f8 // indirect golang.org/x/text v0.3.2 // indirect ) |