Alta Aware — 1571 Golang security vulnerability in net/http before 1.22.5 and 1.21.12

Release Date

11 Nov 2024.

Overview

A denial of service vulnerability (CVE-2024-24791) has been identified in the Go net/http package. The vulnerability arises from improper handling of "Expect: 100-continue" headers, which can leave a client connection in an invalid state. This can be exploited by an attacker to cause a denial of service by sending malformed requests to a reverse proxy, resulting in connection failures and disrupting service.

Affected Products

Alta Video:
- All Stable upgrade channel versions before 6.9.7.
- All Beta upgrade channel versions before 7.0.0.
Avigilon Cloud-Native Cameras:
- All Stable upgrade Channel versions before 6.9.7.
- All Beta upgrade channel versions before 7.0.0.
Alta Video Cloud: before 15th July 2024.

Unaffected Products

Alta Video:
- All Stable upgrade channel versions after and including 6.9.7.
- All Beta upgrade channel versions after and including 7.0.0.
Avigilon Cloud-Native Cameras:
- All Stable upgrade channel versions after and including 6.9.7.
- All Beta upgrade channel versions after and including 7.0.0.
Alta Video Cloud: from 15th July 2024

Resolution

This issue has been fixed in Alta Video Beta upgrade channel version 7.0.0 and Stable upgrade channel version 6.9.7.

It is highly recommended that all installations running an affected version are upgraded to the latest release as soon as possible. Releases are available to download through the Alta Video User Interface.

A fix was deployed to the Alta Video Cloud on 15th July 2024. Alta Video Cloud customers do not need to take any additional action.

This issue has been fixed in Avigilon Cloud-Native Cameras Beta upgrade channel version 7.0.0 and Stable upgrade channel version 6.9.7.

It is highly recommended that all Avigilon Cloud-Native camera installations running an affected version upgrade to the latest release as soon as possible. Releases are available to download through the Alta Video User Interface for Avigilon Cloud-Native cameras and the Avigilon Cloud-Native Camera Interface for unmanaged cameras.

Vulnerability Information

CVE: This is CVE-2024-24791 and Go issue [https://go.dev/issue/67555].
CVSSv3 score: 7.5 (High)
CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Mitigations

There are no known mitigations for this issue.

Work arounds

There are no known work arounds for this issue.

Acknowledgements

Issue reported by the Go Team

Disclosure Timeline

02/07/2024 Issue found
03/07/2024 Root cause established
03/07/2024 Fix identified
15/07/2024 Patched Alta Video Cloud released
02/07/2024 Patched Alta Video (Beta upgrade channel) released
08/07/2024 Patched Alta Video (Stable upgrade channel) released
02/07/2024 Patched Avigilon Cloud-Native Cameras (Beta upgrade channel) released
08/07/2024 Patched Avigilon Cloud-Native Cameras (Stable upgrade channel) released
11/11/2024 Vulnerability publicly disclosed