Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(deps): update module golang.org/x/net to v0.33.0 [security] (#1457)
This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | golang.org/x/net | `v0.30.0` -> `v0.33.0` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. --- ### Non-linear parsing of case-insensitive content in golang.org/x/net/html [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) / [GHSA-w32m-9786-jp63](https://redirect.github.com/advisories/GHSA-w32m-9786-jp63) / [GO-2024-3333](https://pkg.go.dev/vuln/GO-2024-3333) <details> <summary>More information</summary> #### Details An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. #### Severity Unknown #### References - [https://go.dev/cl/637536](https://go.dev/cl/637536) - [https://go.dev/issue/70906](https://go.dev/issue/70906) - [https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ](https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2024-3333) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)). </details> --- ### Non-linear parsing of case-insensitive content in golang.org/x/net/html [CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) / [GHSA-w32m-9786-jp63](https://redirect.github.com/advisories/GHSA-w32m-9786-jp63) / [GO-2024-3333](https://pkg.go.dev/vuln/GO-2024-3333) <details> <summary>More information</summary> #### Details An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service. #### Severity - CVSS Score: Unknown - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-45338](https://nvd.nist.gov/vuln/detail/CVE-2024-45338) - [https://github.com/golang/go/issues/70906](https://redirect.github.com/golang/go/issues/70906) - [https://cs.opensource.google/go/x/net](https://cs.opensource.google/go/x/net) - [https://go.dev/cl/637536](https://go.dev/cl/637536) - [https://go.dev/issue/70906](https://go.dev/issue/70906) - [https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ](https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ) - [https://pkg.go.dev/vuln/GO-2024-3333](https://pkg.go.dev/vuln/GO-2024-3333) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-w32m-9786-jp63) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" in timezone Australia/Sydney, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/google/osv-scanner). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS43Mi41IiwidXBkYXRlZEluVmVyIjoiMzkuNzIuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19--> Co-authored-by: Xueqin Cui <[email protected]>
- Loading branch information
1 parent
bdf7c86
commit 3a6eec9