GitHub Advisoryadvisory · Go
GHSA-99jv-8292-2hpm eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations
LOW
Official page ↗
- Ecosystem
- Go
- Packages
- knative.dev/eventing-gitlab
- Severity
- Low
- Reviewed
- 2023-12-08
Affected packages
• Go knative.dev/eventing-gitlab: <= 0.39.0 (no fix yet)
Description
Impact
The eventing-gitlab cluster-local server doesn't set `ReadHeaderTimeout` which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris attack.
Patches
Fix in `v1.12.1` and `v1.11.3`.
Credits
The vulnerability was reported by Ada Logics during an ongoing security audit of Knative involving Ada Logics, the Knative maintainers, OSTIF and CNCF.
References
- https://github.com/knative-extensions/eventing-gitlab/security/advisories/GHSA-99jv-8292-2hpm web
- https://github.com/knative-extensions/eventing-gitlab/commit/463fcb36ac31cdac34eda0e900b64039d6d30b36 web
- https://github.com/knative-extensions/eventing-gitlab/commit/db76c668aa47890e7fe73c9df3135da292cfd9ec web
- https://github.com/knative-extensions/eventing-gitlab package