cbcvebase.
CVE-2022-21698
published 2022-02-15

CVE-2022-21698: client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers…

PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
5.99%
92.5th percentile
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Affected

33 ranges· showing 25
VendorProductVersion rangeFixed in
debiangolang-github-prometheus-client-golang< golang-github-prometheus-client-golang 1.11.1-1 (bookworm)golang-github-prometheus-client-golang 1.11.1-1 (bookworm)
fedoraprojectextra_packages_for_enterprise_linux
fedoraprojectextra_packages_for_enterprise_linux
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
github.comprometheus_client_golang>= 0 < 1.11.11.11.1
msrcazl3_application-gateway-kubernetes-ingress_1.7.2-2
msrcazl3_application-gateway-kubernetes-ingress_1.7.2-3
msrcazl3_keda_2.14.0-1
msrcazl3_keda_2.4.0-15
msrcazl3_moby-engine_20.10.25-3
msrcazl3_moby-engine_25.0.3-1
msrcazl3_multus_3.8-13
msrcazl3_multus_4.0.2-1
msrcazl3_node-problem-detector_0.8.10-18
msrcazl3_node-problem-detector_0.8.15-1
msrcazl3_prometheus-process-exporter_0.7.10-15
msrcazl3_prometheus-process-exporter_0.8.2-1
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl2_application-gateway-kubernetes-ingress_1.4.0-25
msrccbl2_cri-o_1.22.3-14
msrccbl2_kube-vip-cloud-provider_0.0.2-22

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.