Vulnerability Details : CVE-2021-23409
The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header.
Vulnerability category: Denial of service
Products affected by CVE-2021-23409
- cpe:2.3:a:go-proxyproto_project:go-proxyproto:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-23409
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-23409
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
Snyk |
References for CVE-2021-23409
-
https://github.com/pires/go-proxyproto/issues/65
Add Support for "ProxyHeaderTimeout" · Issue #65 · pires/go-proxyproto · GitHubIssue Tracking;Third Party Advisory
-
https://github.com/pires/go-proxyproto/releases/tag/v0.6.0
Release v0.6.0 · pires/go-proxyproto · GitHubRelease Notes;Third Party Advisory
-
https://github.com/pires/go-proxyproto/pull/74
Add support for ReadHeaderTimeout by unmarshal · Pull Request #74 · pires/go-proxyproto · GitHubPatch;Third Party Advisory
-
https://github.com/pires/go-proxyproto/pull/74/commits/cdc63867da24fc609b727231f682670d0d1cd346
Add support for ReadHeaderTimeout by unmarshal · Pull Request #74 · pires/go-proxyproto · GitHubPatch;Third Party Advisory
-
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPIRESGOPROXYPROTO-1316439
Denial of Service (DoS) in github.com/pires/go-proxyproto | SnykPatch;Third Party Advisory
Jump to