CVE-2023-45290

{"id": "CVE-2023-45290", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-03-05T23:15:07.210", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4", "source": "security@golang.org"}, {"url": "https://go.dev/cl/569341", "source": "security@golang.org"}, {"url": "https://go.dev/issue/65383", "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg", "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2024-2599", "source": "security@golang.org"}, {"url": "https://security.netapp.com/advisory/ntap-20240329-0004/", "source": "security@golang.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://go.dev/cl/569341", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://go.dev/issue/65383", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pkg.go.dev/vuln/GO-2024-2599", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240329-0004/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines."}, {"lang": "es", "value": "Al analizar un formulario de varias partes (ya sea expl\u00edcitamente con Request.ParseMultipartForm o impl\u00edcitamente con Request.FormValue, Request.PostFormValue o Request.FormFile), no se aplicaron l\u00edmites en el tama\u00f1o total del formulario analizado a la memoria consumida al leer un solo formulario l\u00ednea. Esto permite que una entrada creada con fines malintencionados que contenga l\u00edneas muy largas provoque la asignaci\u00f3n de cantidades de memoria arbitrariamente grandes, lo que podr\u00eda provocar un agotamiento de la memoria. Con la correcci\u00f3n, la funci\u00f3n ParseMultipartForm ahora limita correctamente el tama\u00f1o m\u00e1ximo de las l\u00edneas del formulario."}], "lastModified": "2024-11-21T08:26:42.853", "sourceIdentifier": "security@golang.org"}