microsoft/reverse-proxy · Security
YARP Denial of Service Vulnerability
- GHSA ID
- GHSA-jrjw-qgr2-wfcg
- CVE ID
- CVE-2023-33141
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Impact
A denial of service vulnerability exists in YARP.
Patches
If you're using YARP 1.x, you should update to NuGet package version 1.1.2. If you're using YARP 2.0.0, you should update to NuGet package version 2.0.1.
You can do so by updating the PackageReference in your .csproj file
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="2.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="2.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="2.0.1" />
</ItemGroup>
or by selecting 2.0.1 in the NuGet UI inside Visual Studio (Manage NuGet Packages / Updates)
References
CWEs
- CWE-400 · Uncontrolled Resource Consumption
References
- https://github.com/microsoft/reverse-proxy/security/advisories/GHSA-jrjw-qgr2-wfcg ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-33141 ↗
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141 ↗
- https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.2 ↗
- https://www.nuget.org/packages/Yarp.ReverseProxy/2.0.1 ↗
- https://github.com/advisories/GHSA-jrjw-qgr2-wfcg ↗