You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Vulnerable Package issue exists @ GoModules-github.com/prometheus/client_golang-v1.0.0 in branch main
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.
Vulnerable Package issue exists @ GoModules-github.com/prometheus/client_golang-v1.0.0 in branch main
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of
promhttp.InstrumentHandler*
middleware exceptRequestsInFlight
; not filter any specific methods (e.g GET) before middleware; pass metric withmethod
label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknownmethod
. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing themethod
label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.Namespace: amitshalemCx
Repository: ast-advanced-lab
Repository Url: https://github.com/amitshalemCx/ast-advanced-lab
CxAST-Project: amitshalemCx/ast-advanced-lab
CxAST platform scan: e4664af5-6704-4007-97f2-d490d09af097
Branch: main
Application: ast-advanced-lab
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-772
Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: v1.11.1-0.20210607165600-196536534fbb
References
Advisory
Pull request
Commit
Release Note
The text was updated successfully, but these errors were encountered: