CVE-2022-21698

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-21698
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21698.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-21698
Aliases
Related
Published
2022-02-15T16:15:08Z
Modified
2024-10-22T05:28:47.723813Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. clientgolang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

References

Affected packages

Debian:11 / golang-github-prometheus-client-golang

Package

Name
golang-github-prometheus-client-golang
Purl
pkg:deb/debian/golang-github-prometheus-client-golang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.9.0-2
1.11.0-1
1.11.0-2
1.11.0-3
1.11.1-1~bpo11+1
1.11.1-1
1.12.2-1
1.12.2-2
1.12.2-3
1.12.2-4
1.13.0-1
1.13.1-1
1.14.0-1
1.14.0-2
1.14.0-3
1.15.1-1
1.15.1-2
1.16.0-1
1.16.0-2
1.16.0-3
1.16.0-4
1.17.0-1
1.17.0-2
1.18.0-1
1.18.0-2
1.18.0-3
1.19.0-1
1.19.0-2
1.19.1-1
1.19.1-2
1.20.0-1
1.20.1-1
1.20.2-1
1.20.3-1
1.20.3-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / golang-github-prometheus-client-golang

Package

Name
golang-github-prometheus-client-golang
Purl
pkg:deb/debian/golang-github-prometheus-client-golang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.11.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / golang-github-prometheus-client-golang

Package

Name
golang-github-prometheus-client-golang
Purl
pkg:deb/debian/golang-github-prometheus-client-golang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.11.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}