Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/contribsys/faktory

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5GoPublished

    Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input

    CVE-2023-37279 · GHSA-x4hh-vjm7-g2jv

    Affected
    • Go github.com/contribsys/faktory < 1.8.0
    Fixed in
    1.8.0· Vendor fix available
    Issue
    Faktory web dashboard can suffer from denial of service by a crafted malicious url query param days. Details The vulnerability is related to how the backend reads the days URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash. PoC To reproduce this vulnerability, please follow these steps: Start the Faktory Docker and limit memory usage to 512 megabytes for better demonstration: Send the following request. The Faktory server will exit after a few seconds due to out of memory: Impact Server Availability: The vulnerability can crash the Faktory server, affecting its availability. Denial of Service Risk: Given that the Faktory web dashboard does not require authorization, any entity with internet access to the dashboard could potentially exploit this vulnerability. This unchecked access…

    Recommended action: Upgrade to 1.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →