Initial debug-host handler implementation could leak information and facilitate denial of service

published 2023-01-27 3y ago modified 2026-03-03 8mo ago also GO-2023-1524

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact version 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host

### Patches Use 1.6.1 or newer

### Workarounds Downgrade to 1.4.0 or set `debug-host` to empty

### References https://github.com/fortio/proxy/pull/38

Q&A https://github.com/fortio/proxy/discussions

Patch / fix

fixed in 1 links 1

go fortio.org/proxy 1.6.1

github.com/fortio/proxy#38 pull request

Is GHSA-x477-fq37-q5wr in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	fortio.org/proxy	>=1.5.0, <1.6.1	1.6.1

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /fortio/proxy/pull/38
web
github.com /fortio/proxy/security/advisories/GHSA-x477-fq37-q5wr
web, advisory
github.com /fortio/proxy
package

Sources

GitHub Advisory GHSA-x477-fq37-q5wr
OSV GO-2023-1524

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.