GHSA-99jv-8292-2hpm Impact The eventing-gitlab cluster-local server doesn't set `ReadHeaderTimeout` which could lead do a DDoS attack, where a large gro
Attackers can cause denial of service via Slowloris attacks due to missing read header timeouts in the eventing-gitlab server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-99jv-8292-2hpm?
GHSA-99jv-8292-2hpm is a denial of service vulnerability in knative.dev/eventing-gitlab, published on 8 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris attack.
Patches
Fix in v1.12.1 and v1.11.3.
Credits
The vulnerability was reported by Ada Logics during an ongoing security audit of Knative involving Ada Logics, the Knative maintainers, OSTIF and CNCF.
Which versions are affected by GHSA-99jv-8292-2hpm?
2 open source packages ship an affected version, including knative.dev/eventing-gitlab.
| Package | Affected | Fixed in |
|---|---|---|
knative.dev/eventing-gitlab Go | All versions to 0.39.0 | None |
knative.dev/eventing-gitlab Go | All versions to 0.39.0 | None |
How do I fix GHSA-99jv-8292-2hpm?
No fix has been published for GHSA-99jv-8292-2hpm yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-99jv-8292-2hpm being exploited?
There is no known exploitation of GHSA-99jv-8292-2hpm in the wild and no public exploit code.