Red Hat: CVE-2024-24791: net/http: Denial of service due to improper 100-continue handling in net/http (Multiple Advisories)

Red Hat: CVE-2024-24791: net/http: Denial of service due to improper 100-continue handling in net/http (Multiple Advisories)

Severity

5

CVSS

(AV:N/AC:H/Au:N/C:N/I:N/A:C)

Published

07/02/2024

Created

09/25/2024

Added

09/24/2024

Modified

11/13/2024

Description

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

Solution(s)

• redhat-upgrade-aardvark-dns
• redhat-upgrade-buildah
• redhat-upgrade-buildah-debuginfo
• redhat-upgrade-buildah-debugsource
• redhat-upgrade-buildah-tests
• redhat-upgrade-buildah-tests-debuginfo
• redhat-upgrade-cockpit-podman
• redhat-upgrade-conmon
• redhat-upgrade-conmon-debuginfo
• redhat-upgrade-conmon-debugsource
• redhat-upgrade-container-selinux
• redhat-upgrade-containernetworking-plugins
• redhat-upgrade-containernetworking-plugins-debuginfo
• redhat-upgrade-containernetworking-plugins-debugsource
• redhat-upgrade-containers-common
• redhat-upgrade-crit
• redhat-upgrade-criu
• redhat-upgrade-criu-debuginfo
• redhat-upgrade-criu-debugsource
• redhat-upgrade-criu-devel
• redhat-upgrade-criu-libs
• redhat-upgrade-criu-libs-debuginfo
• redhat-upgrade-crun
• redhat-upgrade-crun-debuginfo
• redhat-upgrade-crun-debugsource
• redhat-upgrade-delve
• redhat-upgrade-delve-debuginfo
• redhat-upgrade-delve-debugsource
• redhat-upgrade-fuse-overlayfs
• redhat-upgrade-fuse-overlayfs-debuginfo
• redhat-upgrade-fuse-overlayfs-debugsource
• redhat-upgrade-go-toolset
• redhat-upgrade-golang
• redhat-upgrade-golang-bin
• redhat-upgrade-golang-docs
• redhat-upgrade-golang-misc
• redhat-upgrade-golang-race
• redhat-upgrade-golang-src
• redhat-upgrade-golang-tests
• redhat-upgrade-grafana
• redhat-upgrade-grafana-debuginfo
• redhat-upgrade-grafana-debugsource
• redhat-upgrade-grafana-selinux
• redhat-upgrade-libslirp
• redhat-upgrade-libslirp-debuginfo
• redhat-upgrade-libslirp-debugsource
• redhat-upgrade-libslirp-devel
• redhat-upgrade-netavark
• redhat-upgrade-oci-seccomp-bpf-hook
• redhat-upgrade-oci-seccomp-bpf-hook-debuginfo
• redhat-upgrade-oci-seccomp-bpf-hook-debugsource
• redhat-upgrade-podman
• redhat-upgrade-podman-catatonit
• redhat-upgrade-podman-catatonit-debuginfo
• redhat-upgrade-podman-debuginfo
• redhat-upgrade-podman-debugsource
• redhat-upgrade-podman-docker
• redhat-upgrade-podman-gvproxy
• redhat-upgrade-podman-gvproxy-debuginfo
• redhat-upgrade-podman-plugins
• redhat-upgrade-podman-plugins-debuginfo
• redhat-upgrade-podman-remote
• redhat-upgrade-podman-remote-debuginfo
• redhat-upgrade-podman-tests
• redhat-upgrade-python3-criu
• redhat-upgrade-python3-podman
• redhat-upgrade-runc
• redhat-upgrade-runc-debuginfo
• redhat-upgrade-runc-debugsource
• redhat-upgrade-skopeo
• redhat-upgrade-skopeo-debuginfo
• redhat-upgrade-skopeo-debugsource
• redhat-upgrade-skopeo-tests
• redhat-upgrade-slirp4netns
• redhat-upgrade-slirp4netns-debuginfo
• redhat-upgrade-slirp4netns-debugsource
• redhat-upgrade-toolbox
• redhat-upgrade-toolbox-debuginfo
• redhat-upgrade-toolbox-debugsource
• redhat-upgrade-toolbox-tests
• redhat-upgrade-udica

References

• CVE-2024-24791
• RHSA-2024:6908
• RHSA-2024:6912
• RHSA-2024:6913
• RHSA-2024:6914
• RHSA-2024:6969
• RHSA-2024:7349
• RHSA-2024:9089
• RHSA-2024:9097
• RHSA-2024:9098
• RHSA-2024:9102
• RHSA-2024:9115
• RHSA-2024:9135

View more