blob: 0598d8bb6c10144563c047951c76504639eb2606 [file] [log] [blame]
{
"schema_version": "1.3.1",
"id": "GO-2022-0322",
"modified": "0001-01-01T00:00:00Z",
"published": "2022-07-15T23:29:02Z",
"aliases": [
"CVE-2022-21698",
"GHSA-cg3q-j54f-5p7p"
],
"summary": "Uncontrolled resource consumption in github.com/prometheus/client_golang",
"details": "The Prometheus client_golang HTTP server is vulnerable to a denial of service attack when handling requests with non-standard HTTP methods.\n\nIn order to be affected, an instrumented software must use any of the promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass a metric with a \"method\" label name to a middleware; and not have any firewall/LB/proxy that filters away requests with unknown \"method\".",
"affected": [
{
"package": {
"name": "github.com/prometheus/client_golang",
"ecosystem": "Go"
},
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.1"
}
]
}
],
"ecosystem_specific": {
"imports": [
{
"path": "github.com/prometheus/client_golang/prometheus/promhttp",
"symbols": [
"Handler",
"HandlerFor",
"InstrumentHandlerCounter",
"InstrumentHandlerDuration",
"InstrumentHandlerRequestSize",
"InstrumentHandlerResponseSize",
"InstrumentHandlerTimeToWriteHeader",
"InstrumentMetricHandler",
"InstrumentRoundTripperCounter",
"InstrumentRoundTripperDuration",
"flusherDelegator.Flush",
"readerFromDelegator.ReadFrom",
"responseWriterDelegator.Write",
"responseWriterDelegator.WriteHeader",
"sanitizeMethod"
]
}
]
}
}
],
"references": [
{
"type": "FIX",
"url": "https://github.com/prometheus/client_golang/pull/962"
}
],
"database_specific": {
"url": "https://pkg.go.dev/vuln/GO-2022-0322"
}
}