요약
- CVE-2017-1000098은(는) stdlib, go (golang)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 2.1%, 전체 취약점의 81.5%보다 높음.
- 조치: 1.7.4, 1.6.4 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.7.0-0, < 1.7.4< 1.6.4
| 1.7.41.6.4
|
| go | ≥ 1.7, < 1.7.4< 1.6.4
| 1.7.41.6.4
|
Description
When parsing large multipart/form-data, an attacker can cause a HTTP server to open a large number of file descriptors. This may be used as a denial-of-service vector.
NVD description
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free