GitHub Advisoryadvisory · Go

GHSA-x477-fq37-q5wr Initial debug-host handler implementation could leak information and facilitate denial of service

MEDIUM Published 2023-01-27 Modified 2023-01-27 Official page ↗
Ecosystem
Go
Packages
fortio.org/proxy
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-01-27

Affected packages

• Go fortio.org/proxy: >= 1.5.0, < 1.6.1 → fixed in 1.6.1

Description

Impact version 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host Patches Use 1.6.1 or newer Workarounds Downgrade to 1.4.0 or set `debug-host` to empty References https://github.com/fortio/proxy/pull/38 Q&A https://github.com/fortio/proxy/discussions

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References