GHSA-wxwq-525w-hcqx Yapscan Denial of Service vulnerability in report server
Attackers can cause a Denial of Service in Yapscan's report server if enabled, requiring an upgrade to the patched version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wxwq-525w-hcqx?
GHSA-wxwq-525w-hcqx is a denial of service vulnerability in github.com/fkie-cad/yapscan, published on 3 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
If you use the report server, it may be vulnerable to a Denial of Service attack.
Patches
Has been patched in v0.19.2.
References
The vulnerability was inherited by the following upstream vulnerabilites
Which versions are affected by GHSA-wxwq-525w-hcqx?
3 open source packages ship an affected version, including github.com/fkie-cad/yapscan.
| Package | Affected | Fixed in |
|---|---|---|
github.com/fkie-cad/yapscan Go | From 0.18.0 | 0.19.2 |
github.com/fkie-cad/yapscan Go | From 0.18.0 | 0.19.2 |
github.com/fkie-cad/yapscan Go | From 0.18.0 | 0.19.2 |
How do I fix GHSA-wxwq-525w-hcqx?
Upgrade github.com/fkie-cad/yapscan to 0.19.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-wxwq-525w-hcqx being exploited?
There is no known exploitation of GHSA-wxwq-525w-hcqx in the wild and no public exploit code.
Sources
Also known as GO-2023-1607.