net/http: CVE-2023-45289 affected versions

[ArnoSen]

Go version

n/a

Output of go env in your module/workspace:

n/a

What did you do?

I have been reading the report detailing CVE-2023-45289 at https://mattermost.com/blog/patching-gos-leaky-http-clients/.
This issue has been fixed already in 1.22.1 and 1.21.8
Reading the article, this vulnerability was introduced in https://go-review.googlesource.com/c/go/+/424935 which dates JAN 23 2023.

Prior to this CL, CVE-2023-45289 would not occur because IPv6 addresses would have had square brackets around them.

What did you see happen?

When reading the CVE details at https://www.cve.org/CVERecord?id=CVE-2023-45289, it says all versions up to 1.21.8 are affected.

What did you expect to see?

I would have expected to see that versions released that do not have CL424935 merged would not be affected.

Of course I can understand that earlier versions are supported anymore so maybe it is not relevant but I would like to understand the policy that is maintained for documenting CVE affected versions.

[seankhliao]

cc @golang/security

[tatianab]

Hi, thanks for your comment.

In the general case, it is difficult to determine exactly when a particular vulnerability is introduced, so we err on the side of caution and mark all versions before the fix as vulnerable.

In this particular case, as the article you linked mentions, part of the vulnerability affects versions before https://go-review.googlesource.com/c/go/+/424935 was committed. In addition, that commit was part of Go releases that are old enough to no longer be in our support window.

In cases where the introduced version is known to us, and is recent enough to be within the support window, we would include that in the versions list.

Hope that helps. FYI, if you ever have a further question or suggestion regarding this or another vulnerability report, you can use this issue tracker: https://github.com/golang/vulndb/issues/new/choose (select "Suggest an edit to an existing report").