GHSA-xcf7-q56x-78gh

Source

https://github.com/advisories/GHSA-xcf7-q56x-78gh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-xcf7-q56x-78gh/GHSA-xcf7-q56x-78gh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xcf7-q56x-78gh

Aliases

Published

2021-07-26T21:23:49Z

Modified

2025-01-14T09:11:53.222257Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion

Details

The package github.com/pires/go-proxyproto before 0.6.1 is vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. While this issue was patched in 0.6.0, the fix introduced additional issues which were subsequently patched in 0.6.1.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed_at": "2021-07-26T17:31:53Z",
    "nvd_published_at": "2021-07-21T07:15:00Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/pires/go-proxyproto

Package

Name: github.com/pires/go-proxyproto; View open source insights on deps.dev
Purl: pkg:golang/github.com/pires/go-proxyproto

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.6.1