Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

knative.dev/eventing-github

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedGoPublished

    eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations

    GHSA-v7hc-87jc-qrrr

    Affected
    • Go knative.dev/eventing-github < 0.39.1
    Fixed in
    0.39.1· Vendor fix available
    Issue
    Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬ ‭attack. Patches Fix in v1.12.1 and v1.11.3 Credits The vulnerability was reported by Ada Logics during an ongoing security audit of Knative involving Ada Logics, the Knative maintainers, OSTIF and CNCF.

    Recommended action: Upgrade to 0.39.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →