GHSA-v7hc-87jc-qrrr Impact The eventing-github cluster-local server doesn't set `ReadHeaderTimeout` which could lead do a DDoS attack, where a large gro
Attackers can cause a denial of service via Slowloris attacks due to missing read header timeouts in the Knative eventing-github server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v7hc-87jc-qrrr?
GHSA-v7hc-87jc-qrrr is a denial of service vulnerability in knative.dev/eventing-github, published on 6 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The eventing-github cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris attack.
Patches
Fix in v1.12.1 and v1.11.3
Credits
The vulnerability was reported by Ada Logics during an ongoing security audit of Knative involving Ada Logics, the Knative maintainers, OSTIF and CNCF.
Which versions are affected by GHSA-v7hc-87jc-qrrr?
3 open source packages ship an affected version, including knative.dev/eventing-github.
| Package | Affected | Fixed in |
|---|---|---|
knative.dev/eventing-github Go | All versions | 0.39.1 |
knative.dev/eventing-github Go | All versions | 0.39.1 |
knative.dev/eventing-github Go | All versions | 0.39.1 |
How do I fix GHSA-v7hc-87jc-qrrr?
Upgrade knative.dev/eventing-github to 0.39.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-v7hc-87jc-qrrr being exploited?
There is no known exploitation of GHSA-v7hc-87jc-qrrr in the wild and no public exploit code.
Sources
Also known as GO-2023-2388.