[CVE-2023-45288] net/http, x/net/http2: close connections when receiving too many headers

[dims]

Fixed in golang 1.22.2 released today along with other things.
https://github.com/golang/go/issues?q=milestone%3AGo1.22.2+label%3ACherryPickApproved

we also need to update x/net as well as we use that directly too:
golang/net@ba87210

xref: golang/go#65051

TODO of what we need to do in order to fully close this out:

• Bump golang.org/x/net to v0.23.0 on all supported branches
  • 1.30: [CVE-2023-45288] Update x/net for CVE-2023-45288 #124174
  • 1.29: [CVE-2023-45288][1.29] Bump x/net to v0.23.0 #124180
  • 1.28: [CVE-2023-45288][1.28] Bump x/net to v0.23.0 #124179
  • 1.27: [CVE-2023-45288][1.27] Bump x/net to v0.23.0 #124178
• Bump golang to go1.22.2 or go1.21.9: Dependency update - Golang 1.22.2/1.21.9 release#3529
  • 1.30 needs to be on go1.22.2: [go] Bump images, dependencies and versions to go 1.22.2 and distroless iptables #124196
  • 1.27, 1.28, 1.29 need to be on go1.21.9
    • 1.29: [release-1.29] [go] Bump images, dependencies and versions to go 1.21.9 and distroless iptables and debian-base #124197
    • 1.28: [release-1.28] [go] Bump images, dependencies and versions to go 1.21.9 and distroless iptables #124198
    • 1.27: [release-1.27] [go] Bump images, dependencies and versions to go 1.21.9 and distroless iptables #124199

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dims]

/sig architecture
/priority critical-urgent
/milestone v1.30

cc @kubernetes/release-managers

[dims]

more details in the announce email from golang folks - https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M/m/khALNYGdAAAJ

[ffromani]

perhaps relevant (still checking myself): golang/go#66668

[pacoxu]

/cc @kubernetes/release-team-release-signal

[MadhavJivrajani]

Updated issue description with a TODO list so that we can keep track

[pacoxu]

All PRs in description are merged. Can we close this?

[dims]

/close

[k8s-ci-robot]

@dims: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.