CVE-2022-27664

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 27%
VendorProductVersion
golanggo
𝑥
< 1.18.6
golanggo
1.19.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
golang-1.15
bullseye
vulnerable
buster
postponed
golang-1.19
bookworm
1.19.8-2
fixed
bullseye
no-dsa
buster
postponed
golang-golang-x-net
bullseye
no-dsa
buster
postponed
bookworm
1:0.7.0+dfsg-1
fixed
sid
1:0.27.0-1
fixed
trixie
1:0.27.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
containerd
noble
not-affected
mantic
not-affected
lunar
ignored
jammy
not-affected
focal
not-affected
bionic
not-affected
xenial
not-affected
trusty
ignored
golang
jammy
dne
focal
dne
bionic
dne
xenial
ignored
trusty
ignored
golang-1.10
jammy
dne
focal
dne
bionic
needed
xenial
needed
trusty
needed
golang-1.13
noble
dne
mantic
dne
lunar
dne
kinetic
ignored
jammy
Fixed 1.13.8-1ubuntu2.22.04.2
released
focal
Fixed 1.13.8-1ubuntu1.2
released
bionic
Fixed 1.13.8-1ubuntu1~18.04.4+esm1
released
xenial
Fixed 1.13.8-1ubuntu1~16.04.3+esm3
released
trusty
ignored
golang-1.14
jammy
dne
focal
needed
bionic
dne
xenial
ignored
trusty
ignored
golang-1.16
jammy
dne
focal
Fixed 1.16.2-0ubuntu1~20.04.1
released
bionic
Fixed 1.16.2-0ubuntu1~18.04.2+esm1
released
xenial
ignored
trusty
ignored
golang-1.17
jammy
needed
focal
dne
bionic
dne
xenial
ignored
trusty
ignored
golang-1.18
noble
dne
mantic
dne
lunar
dne
kinetic
dne
jammy
Fixed 1.18.1-1ubuntu1.1
released
focal
Fixed 1.18.1-1ubuntu1~20.04.2
released
bionic
Fixed 1.18.1-1ubuntu1~18.04.4
released
xenial
Fixed 1.18.1-1ubuntu1~16.04.4
released
trusty
ignored
golang-1.6
jammy
dne
focal
dne
bionic
dne
xenial
needed
trusty
ignored
golang-1.8
jammy
dne
focal
dne
bionic
needed
xenial
ignored
trusty
ignored
golang-1.9
jammy
dne
focal
dne
bionic
needed
xenial
ignored
trusty
ignored
golang-golang-x-net
noble
not-affected
mantic
not-affected
lunar
not-affected
jammy
needed
focal
dne
bionic
dne
xenial
dne
trusty
dne
golang-golang-x-net-dev
noble
dne
mantic
dne
lunar
dne
jammy
dne
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne
google-guest-agent
noble
Fixed 20230426.00-0ubuntu2
released
mantic
Fixed 20230426.00-0ubuntu2
released
lunar
ignored
jammy
Fixed 20231004.02-0ubuntu1~22.04.3
released
focal
Fixed 20231004.02-0ubuntu1~20.04.3
released
bionic
needs-triage
xenial
needs-triage
trusty
dne
References
https://groups.google.com/g/golang-announce
https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/
https://security.gentoo.org/glsa/202209-26
https://security.netapp.com/advisory/ntap-20220923-0004/
https://groups.google.com/g/golang-announce
https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/
https://security.gentoo.org/glsa/202209-26
https://security.netapp.com/advisory/ntap-20220923-0004/