{"id":"GHSA-x477-fq37-q5wr","summary":"Initial debug-host handler implementation could leak information and facilitate denial of service","details":"### Impact\nversion 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host\n\n### Patches\nUse 1.6.1 or newer\n\n### Workarounds\nDowngrade to 1.4.0 or set `debug-host` to empty\n\n### References\nhttps://github.com/fortio/proxy/pull/38\n\nQ&A https://github.com/fortio/proxy/discussions","aliases":["GO-2023-1524"],"modified":"2024-08-20T20:59:07.170624Z","published":"2023-01-27T00:55:27Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-200"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2023-01-27T00:55:27Z"},"references":[{"type":"WEB","url":"https://github.com/fortio/proxy/security/advisories/GHSA-x477-fq37-q5wr"},{"type":"WEB","url":"https://github.com/fortio/proxy/pull/38"},{"type":"PACKAGE","url":"https://github.com/fortio/proxy"}],"affected":[{"package":{"name":"fortio.org/proxy","ecosystem":"Go","purl":"pkg:golang/fortio.org/proxy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-x477-fq37-q5wr/GHSA-x477-fq37-q5wr.json"}}],"schema_version":"1.9.0"}