x/vulndb: potential Go vuln in github.com/projectcalico/calico: CVE-2023-41377

[GoVulnBot]

CVE-2023-41377 references github.com/projectcalico/calico, which may be a Go module.

Description:
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-41377
• JSON: https://github.com/CVEProject/cvelist/tree/8c8a0e3ab00f9902bda996f8a29c5e1e537c0aae/2023/41xxx/CVE-2023-41377.json
• web: https://www.tigera.io/security-bulletins-tta-2023-001/
• fix: calico-typha hangs during unclean client TLS handshake projectcalico/calico#7908
• fix: Move TLS handshake to per-connection goroutine projectcalico/calico#7993
• Imported by: https://pkg.go.dev/github.com/projectcalico/calico?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/projectcalico/calico
      vulnerable_at: 2.6.12+incompatible
      packages:
        - package: Typha
cves:
    - CVE-2023-41377
references:
    - web: https://www.tigera.io/security-bulletins-tta-2023-001/
    - fix: https://github.com/projectcalico/calico/pull/7908
    - fix: https://github.com/projectcalico/calico/pull/7993

[gopherbot]

Change https://go.dev/cl/539339 mentions this issue: data/excluded: batch add 7 excluded reports

[gopherbot]

Change https://go.dev/cl/592763 mentions this issue: data/reports: unexclude 75 reports