CVE-2022-21698

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-21698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21698.json
Aliases
Related
Published
2022-02-15T16:15:08Z
Modified
2023-12-28T20:26:22.835620Z
Details

clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. clientgolang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

References

Affected packages

Git / github.com/prometheus/client_golang

Affected ranges

Type
GIT
Repo
https://github.com/prometheus/client_golang
Events
Introduced
0The exact introduced commit is unknown
Fixed
989baa30fe956631907493ccee1f8e7708660d96

Affected versions

0.*

0.1.0
0.2.0
0.3.0
0.3.1
0.3.2
0.4.0
0.5.0
0.6.0
0.7.0

v0.*

v0.8.0
v0.9.0
v0.9.0-pre1
v0.9.1
v0.9.2
v0.9.3
v0.9.4

v1.*

v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.7.1
v1.8.0
v1.9.0