Headline
GHSA-9rpw-2h95-666c: Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
Impact
The sflow decode package prior to version 3.4.4 is vulnerable to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.
Patches
Version 3.4.4 contains patches fixing this.
Workarounds
A possible workaround is to not have your goflow collector publicly reachable.
For more information
If you have any questions or comments about this advisory:
- Open an issue in goflow repo
- Email us netdev[@]cloudflare.com
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2022-2529
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
High severity GitHub Reviewed Published Oct 1, 2022 in cloudflare/goflow • Updated Oct 1, 2022
Package
gomod github.com/cloudflare/goflow/v3/decoders/sflow (Go)
Affected versions
< 3.4.4
Description
Impact
The sflow decode package prior to version 3.4.4 is vulnerable to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.
Patches
Version 3.4.4 contains patches fixing this.
Workarounds
A possible workaround is to not have your goflow collector publicly reachable.
For more information
If you have any questions or comments about this advisory:
- Open an issue in goflow repo
- Email us netdev[@]cloudflare.com
References
- GHSA-9rpw-2h95-666c
- https://nvd.nist.gov/vuln/detail/CVE-2022-2529
Severity
CVSS base metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
GHSA ID
GHSA-9rpw-2h95-666c
Source code
Related news
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.