CPE Details
go-proxyproto Project go-proxyproto 0.4.2
0.4.2
2021-03-08
14h20 +00:00
14h20 +00:00
2021-03-15
15h36 +00:00
15h36 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:a:go-proxyproto_project:go-proxyproto:0.4.2:*:*:*:*:*:*:*
Informations
Vendor
go-proxyproto_projectProduct
go-proxyprotoVersion
0.4.2Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. | 7.5 |
High |
||
| The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers. | 4.9 |
Medium |
