CVE-2019-14243 mastercactapus proxyprotocol vulnerable to denial of service
Remote attackers can crash the Caddy webserver by sending a crafted HAProxy PROXY v2 request with truncated address data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14243?
CVE-2019-14243 is a high-severity denial of service vulnerability in n/a, published on 23 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.
Weakness: CWE-20
Which versions are affected by CVE-2019-14243?
3 open source packages ship an affected version, including github.com/mastercactapus/proxyprotocol. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mastercactapus/proxyprotocol Go | All versions | 0.0.2 |
github.com/mastercactapus/proxyprotocol Go | All versions | 0.0.2 |
github.com/mastercactapus/proxyprotocol Go | All versions | 0.0.2 |
Products include Haproxy Proxyprotocol.
How do I fix CVE-2019-14243?
Upgrade github.com/mastercactapus/proxyprotocol to 0.0.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-14243 being exploited?
There is no known exploitation of CVE-2019-14243 in the wild and no public exploit code.
Sources
Also known as GHSA-85c5-ccm8-vr96, GO-2023-1923.