GHSA-99jv-8292-2hpm: eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. GHSA-99jv-8292-2hpm

eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations

Package

gomod knative.dev/eventing-gitlab (Go)

Affected versions

<= 0.39.0

Description

Impact

The eventing-gitlab cluster-local server doesn’t set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬ ‭attack.

Patches

Fix in v1.12.1 and v1.11.3.

Credits

The vulnerability was reported by Ada Logics during an ongoing security audit of Knative involving Ada Logics, the Knative maintainers, OSTIF and CNCF.

References

• GHSA-99jv-8292-2hpm
• knative-extensions/eventing-gitlab@463fcb3
• knative-extensions/eventing-gitlab@db76c66

Published to the GitHub Advisory Database

Dec 8, 2023