fortio/proxy · Security
Initial debug-host handler implementation could leak information and facilitate denial of service
- GHSA ID
- GHSA-x477-fq37-q5wr
- Severity
- medium
- Published
- Updated
Description
Impact
version 1.5.0 and 1.6.0 when using the new debug-host feature could expose unnecessary information about the host
Patches
Use 1.6.1 or newer
Workarounds
Downgrade to 1.4.0 or set debug-host to empty
References
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor