Denial of Service Vulnerability in eventing-gitlab
Summary
GHSA-99jv-8292-2hpm: Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough t... Affects knative.dev/eventing-gitlab versions < 0.39.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The eventing-gitlab package is a component of Knative, a Kubernetes-based platform for building, deploying, and managing modern serverless workloads. eventing-gitlab is responsible for handling GitLab events and triggering corresponding actions. It is written in Go and is a critical part of the Knative ecosystem.
Vulnerability Detail
The eventing-gitlab package is vulnerable to a denial of service (DoS) attack due to improper enforcement of the timeout on individual read operations. Specifically, the cluster-local server does not set the ReadHeaderTimeout parameter, which can be exploited by malicious actors to launch a distributed denial of service (DDoS) attack. By sending a large number of requests to the server, the attackers can cause it to hang for an extended period, rendering it unavailable to other users. This type of attack is commonly known as a Slowloris attack.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched versions mentioned above to mitigate the risk of a DoS attack.
Conclusion
The eventing-gitlab package is vulnerable to a denial of service attack due to improper enforcement of the timeout on individual read operations. To mitigate this risk, it is crucial to update to version v1.12.1 or v1.11.3 of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for knative.dev/eventing-gitlab →
FAQ
The vulnerability allows for a distributed denial of service (DDoS) attack, where a large group of users can send requests to the server, causing it to hang and deny access to other users.
The vulnerability was reported by Ada Logics during a security audit of Knative involving Ada Logics, the Knative maintainers, OSTIF, and CNCF.
A Slowloris attack is a type of DDoS attack where the attacker sends a large number of partial HTTP requests to a server, keeping the connections open and consuming server resources, eventually leading to denial of service.
No, the vulnerability affects versions up to 0.39.0 of the eventing-gitlab package.
There are no known public exploits of this vulnerability at the time of this advisory.
