CVE-2023-39325

一、漏洞信息
 漏洞编号：[CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325)
 漏洞归属组件：[etcd](https://gitee.com/src-openeuler/etcd)
 漏洞归属的版本：3.4.14,3.4.7
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
 漏洞公开时间：2023-10-12 06:15:09
 漏洞创建时间：2024-01-18 04:46:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-39325
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security.golang.org | https://go.dev/cl/534215 |  |
| security.golang.org | https://go.dev/cl/534235 |  |
| security.golang.org | https://go.dev/issue/63417 |  |
| security.golang.org | https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/ |  |
| security.golang.org | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/ |  |
| security.golang.org | https://pkg.go.dev/vuln/GO-2023-2102 |  |
| security.golang.org | https://security.gentoo.org/glsa/202311-09 |  |
| security.golang.org | https://security.netapp.com/advisory/ntap-20231110-0008/ |  |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5719 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5721 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5738 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5805 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5672 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5675 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5809 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5810 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5677 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5679 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5835 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5738 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5721 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://catalog.redhat.com/software/containers/rhel8/go-toolset/5b9c810add19c70b45cbd666 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5697 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5717 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5851 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5864 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5866 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5865 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5867 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5863 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5931 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5935 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5950 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5951 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5952 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5541 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5530 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5969 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5971 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5970 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5967 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5965 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5964 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5974 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5976 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5979 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5980 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5982 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6031 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5721 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://catalog.redhat.com/software/containers/rhel8/go-toolset/5b9c810add19c70b45cbd666 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://github.com/golang/go/commit/e175f27f58aa7b9cd4d79607ae65d2cd5baaee68 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6039 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6040 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6041 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6042 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6044 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6048 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6057 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6059 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6061 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6071 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:5542 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6077 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2023:6084 | https://bugzilla.redhat.com/show_bug.cgi?id=2243296 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/golang/go/commit/e175f27f58aa7b9cd4d79607ae65d2cd5baaee68 |  | redhat_bugzilla |
|  |  | https://github.com/golang/net/commit/695775ce641b0f80c9cf03e8a796595355422dd3 |  | snyk |
|  |  | https://github.com/golang/net/commit/b225e7ca6dde1ef5a5ae5ce922861bda011cfabd |  | snyk |
|  |  | https://github.com/containerd/containerd/pull/9387 |  | snyk |
|  |  | https://go.dev/cl/534215 |  | nvd |
|  |  | https://go.dev/cl/534235 |  | nvd |
|  |  | https://go.dev/issue/63417 |  | nvd |
|  |  | https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/ |  | nvd |
|  |  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/ |  | nvd |
|  |  | https://pkg.go.dev/vuln/GO-2023-2102 |  | nvd |
|  |  | https://security.gentoo.org/glsa/202311-09 |  | nvd |
|  |  | https://security.netapp.com/advisory/ntap-20231110-0008/ |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  该漏洞允许通过快速重置大量流来消耗服务器资源。此漏洞在2023年8月至10月期间被实际利用，造成了服务器资源的过度消耗，进而导致服务不可用。原理:在HTTP/2中，多个数据流可以并行地在同一个TCP连接上运行。如果客户端能够快速地取消或重置大量的流，这可能导致服务器花费过多的时间和资源处理这些请求的建立和随后的取消或重置操作。攻击者利用这一点，可以通过发送一系列迅速被取消的请求来耗尽服务器资源，从而实现拒绝服务攻击。 上游修复链接:https://go-review.googlesource.com/c/net/+/534236/2/http2/server.go#2047 openEuler master和24.03相关分支已修复该问题，20.03和22.03等相关分支需要合并patch进行修复。
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(3.4.14):受影响
2.openEuler-22.03-LTS(3.4.14):受影响
3.openEuler-22.03-LTS-Next(3.4.14):受影响
4.openEuler-22.03-LTS-SP1(3.4.14):受影响
5.openEuler-22.03-LTS-SP2(3.4.14):受影响
6.openEuler-22.03-LTS-SP3(3.4.14):受影响
7.openEuler-22.03-LTS-SP4(3.4.14):受影响
8.master(3.4.14):不受影响
9.openEuler-20.03-LTS-SP1:不受影响
10.openEuler-24.03-LTS(3.4.14):不受影响
11.openEuler-24.03-LTS-Next(3.4.14):不受影响
12.openEuler-24.03-LTS-SP1(3.4.14):不受影响

修复是否涉及abi变化(是/否)：
  1.master(3.4.14):否
2.openEuler-20.03-LTS-SP1:否
3.openEuler-20.03-LTS-SP4(3.4.14):否
4.openEuler-22.03-LTS(3.4.14):否
5.openEuler-22.03-LTS-Next(3.4.14):否
6.openEuler-22.03-LTS-SP1(3.4.14):否
7.openEuler-22.03-LTS-SP2(3.4.14):否
8.openEuler-22.03-LTS-SP3(3.4.14):否
9.openEuler-22.03-LTS-SP4(3.4.14):否
10.openEuler-24.03-LTS(3.4.14):否
11.openEuler-24.03-LTS-Next(3.4.14):否
12.openEuler-24.03-LTS-SP1(3.4.14):否

原因说明：
  1.master(3.4.14):
2.openEuler-20.03-LTS-SP4(3.4.14):
3.openEuler-22.03-LTS-SP3(3.4.14):
4.openEuler-22.03-LTS-SP4(3.4.14):
5.openEuler-24.03-LTS(3.4.14):
6.openEuler-24.03-LTS-Next(3.4.14):
7.openEuler-24.03-LTS-SP1(3.4.14):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1185

src-openEuler/etcd

内容风险标识

评论 (9)

src-openEuler/etcd .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-39325

评论 (9)

搜索帮助

src-openEuler/etcd