Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http: panic due to racy read of persistConn after handler panic [1.15 backport] #47473

Closed
gopherbot opened this issue Jul 30, 2021 · 3 comments
Closed

net/http: panic due to racy read of persistConn after handler panic [1.15 backport] #47473

gopherbot opened this issue Jul 30, 2021 · 3 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Milestone
Go1.15.15

Comments

@gopherbot
Copy link

@FiloSottile requested issue #46866 to be considered for backport to the next 1.15 minor release.

@gopherbot, please open backport issues for CL 333191 as a potential security fix.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Jul 30, 2021
@gopherbot gopherbot mentioned this issue Jul 30, 2021
Closed
@gopherbot gopherbot added this to the Go1.15.15 milestone Jul 30, 2021
@gopherbot
Copy link
Author

Change https://golang.org/cl/338550 mentions this issue: [release-branch.go1.15] net/http/httputil: close incoming ReverseProxy request body

@dmitshur dmitshur mentioned this issue Aug 2, 2021
Closed
@dmitshur
Copy link
Contributor

dmitshur commented Aug 2, 2021

Approved as a fix for a security issue. This backport applies to both 1.16 (#47474) and 1.15 (this issue).

@dmitshur dmitshur added CherryPickApproved Used during the release process for point releases and removed CherryPickCandidate Used during the release process for point releases labels Aug 2, 2021
@gopherbot
Copy link
Author

Closed by merging ba93baa to release-branch.go1.15.

gopherbot pushed a commit that referenced this issue Aug 2, 2021
@neild @cagedmantis
[release-branch.go1.15] net/http/httputil: close incoming ReverseProx…
ba93baa 
…y request body

Reading from an incoming request body after the request handler aborts
with a panic can cause a panic, becuse http.Server does not (contrary
to its documentation) close the request body in this case.

Always close the incoming request body in ReverseProxy.ServeHTTP to
ensure that any in-flight outgoing requests using the body do not
read from it.

Fixes #47473
Updates #46866
Fixes CVE-2021-36221

Change-Id: I310df269200ad8732c5d9f1a2b00de68725831df
Reviewed-on: https://go-review.googlesource.com/c/go/+/333191
Trust: Damien Neil <dneil@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
(cherry picked from commit b7a85e0)
Reviewed-on: https://go-review.googlesource.com/c/go/+/338550
Trust: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
@golang golang locked and limited conversation to collaborators Aug 2, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Projects
None yet
Milestone
Go1.15.15
Development

No branches or pull requests
3 participants
@FiloSottile @dmitshur @gopherbot