Esta página ainda não foi traduzida para o seu idioma. Exibindo conteúdo em inglês enquanto trabalhamos nisso.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2017-16118: DoS in forwarded Go Package
traduzindo…Plataforma
nodejs
Componente
forwarded
Corrigido em
0.1.2
CVE-2017-16118 describes a Denial of Service (DoS) vulnerability within the forwarded Go package. This vulnerability arises from the package's handling of regular expressions when parsing user input, allowing an attacker to trigger a denial of service. Affected versions are those prior to 0.1.2. A fix is available in version 0.1.2.
Impacto e Cenários de Ataquetraduzindo…
An attacker can exploit this vulnerability by sending specially crafted input to applications utilizing the forwarded package. This malicious input triggers a computationally expensive regular expression match, effectively exhausting server resources and leading to a denial of service. The impact can range from temporary service unavailability to complete system crashes, disrupting operations and potentially impacting user access. The blast radius extends to any application relying on the vulnerable forwarded package, particularly those handling external user input without proper sanitization.
Contexto de Exploraçãotraduzindo…
CVE-2017-16118 was published on July 24, 2018. There is no indication of active exploitation campaigns targeting this vulnerability. The EPSS score is likely low given the lack of public exploits and the relatively straightforward mitigation (package upgrade). No known KEV status.
Inteligência de Ameaças
Status do Exploit
EPSS
0.60% (percentil 69%)
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Nenhum — sem autenticação necessária para explorar.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Nenhum — sem impacto na confidencialidade.
- Integrity
- Nenhum — sem impacto na integridade.
- Availability
- Alto — falha completa ou esgotamento de recursos. Negação de serviço total.
Linha do tempo
- Publicada
- Modificada
- EPSS atualizado
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2017-16118 is to upgrade the forwarded Go package to version 0.1.2 or later. If upgrading is not immediately feasible, consider implementing input validation and sanitization to prevent the injection of malicious regular expressions. Specifically, restrict the characters allowed in the X-Forwarded-For header or other relevant fields. While not a complete solution, this can reduce the likelihood of exploitation. After upgrading, confirm the fix by sending a test payload containing a known malicious regular expression and verifying that the application does not crash or exhibit performance degradation.
Como corrigirtraduzindo…
Nenhum patch oficial disponível. Procure alternativas ou monitore atualizações.
Perguntas frequentestraduzindo…
What is CVE-2017-16118 — DoS in forwarded Go Package?
CVE-2017-16118 is a denial-of-service vulnerability in the forwarded Go package. A crafted input can trigger a resource-intensive regular expression, leading to service disruption.
Am I affected by CVE-2017-16118 in forwarded Go Package?
You are affected if you are using a version of the forwarded Go package prior to 0.1.2 in your Go applications.
How do I fix CVE-2017-16118 in forwarded Go Package?
Upgrade the forwarded Go package to version 0.1.2 or later. Implement input validation as a temporary workaround if upgrading is not immediately possible.
Is CVE-2017-16118 being actively exploited?
There is currently no evidence of active exploitation campaigns targeting CVE-2017-16118.
Where can I find the official forwarded advisory for CVE-2017-16118?
Refer to the GitHub repository for the forwarded package for updates and advisories: https://github.com/posener/forwarded
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Experimente agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...