NVD Vulnerability Detail

CVE-2019-14243

Summary	headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.
Publication Date	July 24, 2019, 7:15 a.m.
Registration Date	Jan. 26, 2021, 11:39 a.m.
Last Update	Nov. 21, 2024, 1:26 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:haproxy:proxyprotocol::::::caddy::*					0.0.2

Related information, measures and tools

No	URL	タグ
1	https://caddy.community/t/dos-in-http-proxyprotocol-plugin/6014	Third Party Advisory
2	https://caddy.community/t/dos-in-http-proxyprotocol-plugin/6014	Third Party Advisory
3	https://github.com/mastercactapus/caddy-proxyprotocol/issues/8	Issue Tracking Third Party Advisory
4	https://github.com/mastercactapus/caddy-proxyprotocol/issues/8	Issue Tracking Third Party Advisory
5	https://github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90ac	Patch Third Party Advisory
6	https://github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90ac	Patch Third Party Advisory
7	https://github.com/mastercactapus/proxyprotocol/compare/ef496d7...5c4a101	Third Party Advisory
8	https://github.com/mastercactapus/proxyprotocol/compare/ef496d7...5c4a101	Third Party Advisory
9	https://github.com/mastercactapus/proxyprotocol/issues/1	Exploit Third Party Advisory
10	https://github.com/mastercactapus/proxyprotocol/issues/1	Exploit Third Party Advisory
11	https://github.com/mastercactapus/proxyprotocol/releases/tag/v0.0.2	Release Notes Third Party Advisory
12	https://github.com/mastercactapus/proxyprotocol/releases/tag/v0.0.2	Release Notes Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

mastercactapus proxyprotocol における入力確認に関する脆弱性

Title	mastercactapus proxyprotocol における入力確認に関する脆弱性
Summary	mastercactapus proxyprotocol には、入力確認に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 23, 2019, midnight
Registration Date	Aug. 5, 2019, 11:46 a.m.
Last Update	Aug. 5, 2019, 11:46 a.m.

Affected System

proxyprotocol project

proxyprotocol 0.0.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-14243	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14243
National Vulnerability Database (NVD)
2	CVE-2019-14243	https://nvd.nist.gov/vuln/detail/CVE-2019-14243

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
GitHub
1	Add test and fix for malformed/truncated header	https://github.com/mastercactapus/proxyprotocol/commit/5c4a101121fc3e868026189c7a73f7f19eef90ac
2	Comparing changes	https://github.com/mastercactapus/proxyprotocol/compare/ef496d7...5c4a101
3	Denial of service vulnerability with invalid v2 PROXY data #8	https://github.com/mastercactapus/caddy-proxyprotocol/issues/8
4	Invalid V2 PROXY data causes parsing panics/denial-of-service #1	https://github.com/mastercactapus/proxyprotocol/issues/1
5	v0.0.2	https://github.com/mastercactapus/proxyprotocol/releases/tag/v0.0.2

Change Log

No	Changed Details	Date of change
1	[2019年08月05日] 掲載	Aug. 5, 2019, 11:46 a.m.