CVE-2024-24791

Description

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.41%• Percentile: 72%

Affected Systems

• chainguard•aactl

  < 0.4.12-r15

• chainguard•actions-runner-controller

  < 0.9.3-r1

• chainguard•actions-runner-controller-fips

  < 0.9.3-r1

• chainguard•addon-resizer

  < 1.8.22-r1

• chainguard•addon-resizer-fips

  < 1.8.22-r1

• chainguard•age

  < 1.2.0-r1

• chainguard•amass

  < 4.2.0-r12

• chainguard•argo-workflows

  < 3.6.5-r2

• chainguard•atlantis

  < 0.28.3-r1

• chainguard•atlantis-fips

  < 0.28.3-r2

• chainguard•authservice

  < 1.0.1-r1

• chainguard•authservice-fips

  < 1.0.1-r1

• chainguard•aws-ebs-csi-driver

  < 1.32.0-r1

• chainguard•aws-efs-csi-driver

  < 2.0.5-r1

• chainguard•aws-efs-csi-driver-fips

  < 1.7.0-r12

• chainguard•aws-flb-cloudwatch

  < 1.9.4-r12

• chainguard•aws-flb-firehose

  < 1.7.2-r12

• chainguard•aws-flb-kinesis

  < 1.10.2-r13

• chainguard•aws-load-balancer-controller

  < 2.8.1-r2

• chainguard•aws-load-balancer-controller-fips

  < 2.8.1-r1

• chainguard•aws-network-policy-agent

  < 1.1.2-r1

• chainguard•azcopy-fips

  < 10.25.1-r1

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r11

• chainguard•bank-vaults

  < 1.20.4-r17

• chainguard•bank-vaults-fips

  < 1.20.4-r14

• chainguard•bazelisk

  < 1.20.0-r4

• chainguard•bom

  < 0.6.0-r7

• chainguard•boring-registry

  < 0.14.0-r4

• chainguard•boring-registry-fips

  < 0.14.0-r6

• chainguard•buf

  < 1.34.0-r1

• chainguard•buildah

  < 1.36.0-r2

• chainguard•caddy

  < 2.8.4-r2

• chainguard•caddy-fips

  < 2.8.4-r2

• chainguard•cadvisor

  < 0.49.1-r9

• chainguard•cadvisor-fips

  < 0.49.1-r8

• chainguard•capslock

  < 0.2.3-r1

• chainguard•cass-operator

  < 1.21.1-r1

• chainguard•cass-operator-fips-no-pvc-delete

  < 1.21.1-r1

• chainguard•cert-exporter

  < 2.12.0-r7

• chainguard•cert-exporter-fips

  < 2.12.0-r8

• chainguard•cert-manager-cmctl

  < 2.1.0-r1

• chainguard•cert-manager-cmctl-fips

  < 2.1.0-r1

• chainguard•cert-manager-webhook-pdns

  < 2.5.1-r5

• chainguard•cert-manager-webhook-pdns-fips

  < 2.5.1-r6

• chainguard•certificate-transparency

  < 1.2.1-r2

• chainguard•certificate-transparency-fips

  < 1.2.1-r2

• chainguard•cfssl

  < 1.6.5-r8

• chainguard•chainctl

  < 0.2.59-r0

• chainguard•chartmuseum

  < 0.16.2-r3

• chainguard•chartmuseum-fips

  < 0.16.2-r1

Showing first 50 affected entries in server-rendered view.

References (13)

• https://go.dev/cl/591255
• https://go.dev/issue/67555
• https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ
• https://pkg.go.dev/vuln/GO-2024-2963
• https://security.netapp.com/advisory/ntap-20241004-0004/
• https://access.redhat.com/errata/RHSA-2024:7349
• https://access.redhat.com/security/updates/classification/#moderate
• https://bugzilla.redhat.com/show_bug.cgi?id=2295310
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7349.json
• https://access.redhat.com/security/cve/CVE-2024-24791
• https://www.cve.org/CVERecord?id=CVE-2024-24791
• https://nvd.nist.gov/vuln/detail/CVE-2024-24791
• https://security-tracker.debian.org/tracker/CVE-2024-24791