~ / search / GHSA-xcf7-q56x-78gh

GHSA-xcf7-q56x-78gh

github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion

Source: GitHub Advisory Database (reviewed) High CVE-2021-23409

Packages

EcosystemPackageAffectedFixed in
Go github.com/pires/go-proxyproto < 0.6.1 0.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package `github.com/pires/go-proxyproto` before 0.6.1 is vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. While this issue was patched in 0.6.0, the fix introduced additional issues which were subsequently patched in 0.6.1.

References

External links from the advisory. They lead to third-party sites.