eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations
Low severity
GitHub Reviewed
Published
Dec 6, 2023
in
knative-extensions/eventing-gitlab
•
Updated Dec 8, 2023
Description
Published to the GitHub Advisory Database
Dec 8, 2023
Reviewed
Dec 8, 2023
Last updated
Dec 8, 2023
Impact
The eventing-gitlab cluster-local server doesn't set
ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris attack.Patches
Fix in
v1.12.1andv1.11.3.Credits
The vulnerability was reported by Ada Logics during an ongoing security audit of Knative involving Ada Logics, the Knative maintainers, OSTIF and CNCF.
References