CVE-2019-14243: Input Validation
First published: Tue Jul 23 2019(Updated: )
headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/mastercactapus/proxyprotocol | <0.0.2 | 0.0.2 |
| Haproxy Proxyprotocol | <0.0.2 |
Remedy
https://github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90ac
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-14243
- https://github.com/mastercactapus/caddy-proxyprotocol/issues/8
- https://github.com/mastercactapus/proxyprotocol/issues/1
- https://github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90ac
- https://caddy.community/t/dos-in-http-proxyprotocol-plugin/6014
- https://github.com/mastercactapus/proxyprotocol/compare/ef496d7...5c4a101
- https://github.com/mastercactapus/proxyprotocol/releases/tag/v0.0.2
- https://github.com/advisories/GHSA-85c5-ccm8-vr96 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2019-14243?
The severity of CVE-2019-14243 is high.
How does CVE-2019-14243 affect the mastercactapus proxyprotocol package?
CVE-2019-14243 affects the mastercactapus proxyprotocol package version 0.0.2.
What is the impact of CVE-2019-14243?
CVE-2019-14243 allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination.
How can I mitigate CVE-2019-14243?
To mitigate CVE-2019-14243, update the mastercactapus proxyprotocol package to version 0.0.2 or later.
Where can I find more information about CVE-2019-14243?
You can find more information about CVE-2019-14243 in the following references: [1], [2], [3].
- collector/github-advisory-latest
- alias/GHSA-85c5-ccm8-vr96
- alias/CVE-2019-14243
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- agent/trending
- package-manager/go
- vendor/haproxy
- canonical/haproxy proxyprotocol