Wind River Support Network

HomeDefectsLIN1021-5074

Acknowledged

LIN1021-5074 : Security Advisory - go - CVE-2022-41721

Created: Jan 17, 2023 Updated: Jan 30, 2023

Found In Version: 10.21.20.1

Severity: Standard

Applicable for: Wind River Linux LTS 21

Component/s: Userspace

Description

Golang: A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

CREATE(Triage):(User=admin) CVE-2022-41721 (https://nvd.nist.gov/vuln/detail/CVE-2022-41721)