PT-2023-33003 · Unknown · Eventing-Gitlab Cluster-Local Server

Published 2023-12-08 · Updated 2023-12-08

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions eventing-gitlab cluster-local server versions prior to v1.11.3 eventing-gitlab cluster-local server versions prior to v1.12.1

Description The issue arises because the eventing-gitlab cluster-local server does not set the ReadHeaderTimeout variable, making it susceptible to a DDoS attack, specifically a Slowloris attack. This type of attack occurs when a large number of users send requests to the server, causing it to hang for an extended period and denying access to other users.

Recommendations For versions prior to v1.11.3, update to v1.11.3 to resolve the issue. For versions prior to v1.12.1, update to v1.12.1 to resolve the issue. As a temporary workaround, consider setting the ReadHeaderTimeout variable to prevent the server from hanging due to Slowloris attacks.

Related Identifiers

GHSA-99JV-8292-2HPM

Affected Products

Eventing-Gitlab Cluster-Local Server

References · 5

• https://osv.dev/vulnerability/GHSA-99jv-8292-2hpm · Vendor Advisory
• https://github.com/knative-extensions/eventing-gitlab/commit/db76c668aa47890e7fe73c9df3135da292cfd9ec · Note
• https://github.com/knative-extensions/eventing-gitlab/security/advisories/GHSA-99jv-8292-2hpm · Note
• https://github.com/knative-extensions/eventing-gitlab/commit/463fcb36ac31cdac34eda0e900b64039d6d30b36 · Note
• https://github.com/knative-extensions/eventing-gitlab · Note