PT-2023-33003 · Unknown · Eventing-Gitlab Cluster-Local Server

Publicado 2023-12-08 · Atualizado 2023-12-08

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions eventing-gitlab cluster-local server versions prior to v1.11.3 eventing-gitlab cluster-local server versions prior to v1.12.1

Description The issue arises because the eventing-gitlab cluster-local server does not set the ReadHeaderTimeout variable, making it susceptible to a DDoS attack, specifically a Slowloris attack. This type of attack occurs when a large number of users send requests to the server, causing it to hang for an extended period and denying access to other users.

Recommendations For versions prior to v1.11.3, update to v1.11.3 to resolve the issue. For versions prior to v1.12.1, update to v1.12.1 to resolve the issue. As a temporary workaround, consider setting the ReadHeaderTimeout variable to prevent the server from hanging due to Slowloris attacks.

Identificadores relacionados

GHSA-99JV-8292-2HPM

Produtos afetados

Eventing-Gitlab Cluster-Local Server

Referências · 5

• https://github.com/knative-extensions/eventing-gitlab/commit/db76c668aa47890e7fe73c9df3135da292cfd9ec · Nota
• https://github.com/knative-extensions/eventing-gitlab/security/advisories/GHSA-99jv-8292-2hpm · Nota
• https://github.com/knative-extensions/eventing-gitlab/commit/463fcb36ac31cdac34eda0e900b64039d6d30b36 · Nota
• https://github.com/knative-extensions/eventing-gitlab · Nota
• https://osv.dev/vulnerability/GHSA-99jv-8292-2hpm · Aviso do Fabricante