CVE-2021-23351 Denial of Service (DoS)
An attacker can cause a denial of service by sending malformed proxy protocol headers that exhaust memory in applications using this Go library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23351?
CVE-2021-23351 is a medium-severity denial of service vulnerability in Fedoraproject Fedora, published on 8 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers.
Which versions are affected by CVE-2021-23351?
2 open source packages ship an affected version, including github.com/pires/go-proxyproto. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pires/go-proxyproto Go | All versions | 0.5.0 |
github.com/pires/go-proxyproto Go | All versions | 0.5.0 |
Products include Fedoraproject Fedora, Go-Proxyproto Project Go-Proxyproto.
How do I fix CVE-2021-23351?
Upgrade github.com/pires/go-proxyproto to 0.5.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-23351 being exploited?
There is no known exploitation of CVE-2021-23351 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2021-23351, GHSA-fqh4-rh59-xhvf, SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1081577, UBUNTU-CVE-2021-23351.