chore(deps): update module golang.org/x/net to v0.23.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
golang.org/x/net	v0.17.0 -> v0.23.0

---

HTTP/2 CONTINUATION flood in net/http

BIT-golang-2023-45288 / CVE-2023-45288 / GO-2024-2687

More information

Details

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.

This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.

The fix sets a limit on the amount of excess header frames we will process before closing a connection.

Severity

Unknown

References

• https://go.dev/issue/65051
• https://go.dev/cl/576155
• https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

Coverage from tests in ./e2e_test/... for ./consensus/istanbul/... at commit 7859a78

coverage: 50.7% of statements across all listed packages

coverage:  63.4% of statements in consensus/istanbul
coverage:  42.7% of statements in consensus/istanbul/announce
coverage:  55.7% of statements in consensus/istanbul/backend
coverage:   0.0% of statements in consensus/istanbul/backend/backendtest
coverage:  24.3% of statements in consensus/istanbul/backend/internal/replica
coverage:  64.6% of statements in consensus/istanbul/core
coverage:  50.0% of statements in consensus/istanbul/db
coverage:   0.0% of statements in consensus/istanbul/proxy
coverage:  64.2% of statements in consensus/istanbul/uptime
coverage:  51.8% of statements in consensus/istanbul/validator
coverage:  79.2% of statements in consensus/istanbul/validator/random

[github-actions]

Test failures:
TestMiner: miner Failed /runner/_work/celo-blockchain/celo-blockchain/consensus/consensustest/mockprotocol.go:384 +0x181 /runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:466 +0xb3 /runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:308 +0x515 /runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:410 +0x3b /runner/_work/celo-blockchain/celo-blockchain/miner/worker.go:409 +0x1aa
This test report was produced by the test-summary action.  Made with ❤️ in Cambridge.

[karlb]

The change looks safe and upstream also updated to the same package versions.