PT-2021-6597 · Pypi+1 · Go-Proxyproto+1

Tecnobrat + 1 · Published 2021-01-27 · Updated 2022-07-01 · CVE-2021-23409

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions github.com/pires/go-proxyproto versions prior to 0.6.0

Description The vulnerability in the github.com/pires/go-proxyproto library is related to the lack of a timeout when waiting for the proxy protocol header. This allows a remote attacker to cause a denial of service by creating connections without the proxy protocol header, leading to resource exhaustion. The issue can be exploited by opening many connections and sending no data on them.

Recommendations For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue. Additionally, consider configuring a user-defined header timeout to prevent similar issues in the future. As a temporary workaround, consider restricting access to the PROXY protocol server to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-01863

CVE-2021-23409

GHSA-XCF7-Q56X-78GH

GO-2022-0233

SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439

Affected Products

Debian

Go-Proxyproto

References · 24

• https://github.com/pires/go-proxyproto/pull/74/commits/cdc63867da24fc609b727231f682670d0d1cd346 · Patch
• https://github.com/pires/go-proxyproto/pull/74 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-23409 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23409 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xcf7-q56x-78gh · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0233 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-23409 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-23409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23409 · Security Note
• https://bdu.fstec.ru/vul/2022-01863 · Security Note
• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439 · Patch
• https://ubuntu.com/security/CVE-2021-23409 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-23409 · Vendor Advisory
• https://github.com/pires/go-proxyproto/releases/tag/v0.6.0 · Note
• https://github.com/pires/go-proxyproto/issues/65 · Note