GMS-2023-165: Initial debug-host handler implementation could leak information and facilitate denial of service

January 27, 2023

Impact

version 1.5.0 and 1.6.0 when using the new debug-host feature could expose unnecessary information about the host

Patches

Use 1.6.1 or newer

Workarounds

Downgrade to 1.4.0 or set debug-host to empty

References

https://github.com/fortio/proxy/pull/38

Q&A https://github.com/fortio/proxy/discussions

References

github.com/advisories/GHSA-x477-fq37-q5wr
github.com/fortio/proxy/pull/38
github.com/fortio/proxy/security/advisories/GHSA-x477-fq37-q5wr

Code Behaviors & Features

Detect and mitigate GMS-2023-165 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →