Log in Start free

Vulnerability · Published Mar 8, 2021 · Assigned by snyk

CVE-2021-23351Denial of Service (DoS)

Medium 4.4

In plain English

A medium-severity security flaw in github.com/pires/go-proxyproto. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)1.9%top 20.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-pires-go-proxyproto0.4.2-1DEBIAN-CVE-2021-23351
Debian:13golang-github-pires-go-proxyproto0.4.2-1DEBIAN-CVE-2021-23351
Debian:14golang-github-pires-go-proxyproto0.4.2-1DEBIAN-CVE-2021-23351
Gogithub.com/pires/go-proxyproto0.5.0GHSA-fqh4-rh59-xhvf
Ubuntu:22.04:LTSgolang-github-pires-go-proxyprotono fix listedUBUNTU-CVE-2021-23351

Affected products (as reported)

VendorProductVersions
n/a github.com/pires/go-proxyproto unspecified – before 0.5.0

References