GHSA-x477-fq37-q5wr

Source

https://github.com/advisories/GHSA-x477-fq37-q5wr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-x477-fq37-q5wr/GHSA-x477-fq37-q5wr.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-x477-fq37-q5wr

Aliases

GO-2023-1524

Published

2023-01-27T00:55:27Z

Modified

2024-08-20T20:59:19.555021Z

Summary

Initial debug-host handler implementation could leak information and facilitate denial of service

Details

Impact

version 1.5.0 and 1.6.0 when using the new debug-host feature could expose unnecessary information about the host

Patches

Use 1.6.1 or newer

Workarounds

Downgrade to 1.4.0 or set debug-host to empty

References

https://github.com/fortio/proxy/pull/38

Q&A https://github.com/fortio/proxy/discussions

Database specific

{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed_at": "2023-01-27T00:55:27Z",
    "nvd_published_at": null,
    "github_reviewed": true
}

References

Affected packages

Go / fortio.org/proxy

Package

Name: fortio.org/proxy; View open source insights on deps.dev
Purl: pkg:golang/fortio.org/proxy

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0

Fixed

1.6.1