27 lines
798 B
Diff
27 lines
798 B
Diff
From 03bccc9aa2a29a03f5a65d56b0ceaace4a66a0d5 Mon Sep 17 00:00:00 2001
|
|
From: rpm-build <rpm-build>
|
|
Date: Sat, 11 May 2024 10:33:04 +0800
|
|
Subject: [PATCH] fix CVE-2023-29406
|
|
|
|
---
|
|
vendor/golang.org/x/net/http2/transport.go | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go
|
|
index 4f09897..e1bb430 100644
|
|
--- a/vendor/golang.org/x/net/http2/transport.go
|
|
+++ b/vendor/golang.org/x/net/http2/transport.go
|
|
@@ -1739,6 +1739,9 @@ func (cc *ClientConn) encodeHeaders(req *http.Request, addGzipHeader bool, trail
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
+ if !httpguts.ValidHostHeader(host) {
|
|
+ return nil, errors.New("http: invalid Host header")
|
|
+ }
|
|
|
|
var path string
|
|
if req.Method != "CONNECT" {
|
|
--
|
|
2.33.0
|
|
|