GHSA-x477-fq37-q5wr

Source

https://github.com/advisories/GHSA-x477-fq37-q5wr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-x477-fq37-q5wr/GHSA-x477-fq37-q5wr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x477-fq37-q5wr

Aliases

GO-2023-1524

Published

2023-01-27T00:55:27Z

Modified

2024-08-20T20:59:07Z

Summary

Initial debug-host handler implementation could leak information and facilitate denial of service

Details

Impact

version 1.5.0 and 1.6.0 when using the new debug-host feature could expose unnecessary information about the host

Patches

Use 1.6.1 or newer

Workarounds

Downgrade to 1.4.0 or set debug-host to empty

References

https://github.com/fortio/proxy/pull/38

Q&A https://github.com/fortio/proxy/discussions

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-01-27T00:55:27Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / fortio.org/proxy

Package

Name: fortio.org/proxy; View open source insights on deps.dev
Purl: pkg:golang/fortio.org/proxy

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0

Fixed

1.6.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-x477-fq37-q5wr/GHSA-x477-fq37-q5wr.json"