Bug 1217625 (CVE-2023-45286) - VUL-0: TRACKERBUG: CVE-2023-45286: go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2
Summary: VUL-0: TRACKERBUG: CVE-2023-45286: go-resty: HTTP request body disclosure in ...
Status: RESOLVED FIXED
Alias: CVE-2023-45286
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/386351/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-29 08:57 UTC by SMASH SMASH
Modified: 2023-11-29 10:08 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-11-29 08:57:45 UTC 
A race condition in go-resty can result in HTTP request body disclosure across
requests. This condition can be triggered by calling sync.Pool.Put with the same
*bytes.Buffer more than once, when request retries are enabled and a retry
occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't
had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP
request body from an unrelated request, and go-resty will append the current
HTTP request body to it, sending two bodies in one request. The sync.Pool in
question is defined at package level scope, so a completely unrelated server
could receive the request body.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45286
Comment 1 Thomas Leroy 2023-11-29 09:43:45 UTC 
resty/v2 embedded in the following packages:


openSUSE:Factory/golang-github-prometheus-prometheus,3,github.com/go-resty/resty/v2,v2.7.0

openSUSE:Factory/teleport,8,github.com/go-resty/resty/v2,v2.3.0

openSUSE:Factory/traefik,9,github.com/go-resty/resty/v2,v2.1.1-0.20191201195748-d7b97669fe48

openSUSE:Factory/weave-gitops,9,github.com/go-resty/resty/v2,v2.7.0

SUSE:ALP:Source:Standard:1.0/golang-github-prometheus-prometheus,3,github.com/go-resty/resty/v2,v2.7.0

SUSE:SLE-12:Update/golang-github-prometheus-prometheus,1,github.com/go-resty/resty/v2,v2.1.1-0.20191201195748-d7b97669fe48

SUSE:SLE-15-SP1:Update/golang-github-prometheus-prometheus,1,github.com/go-resty/resty/v2,v2.1.1-0.20191201195748-d7b97669fe48

SUSE:SLE-15-SP3:Update:Products:SES7:Update/rook,3,gopkg.in/resty.v1,v1.12.0

SUSE:SLE-15:Update/golang-github-prometheus-prometheus,1,github.com/go-resty/resty/v2,v2.1.1-0.20191201195748-d7b97669fe48
Comment 2 Thomas Leroy 2023-11-29 10:08:29 UTC 
The issue was introduced in go-resty/v2 v2.10.0. None of the packages are affected. Closing