You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.
This issue affects hackney: from 0.10.0 before 4.0.1.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Title: hackney de benoitc, Description: Una vulnerabilidad de Consumo de Recursos Incontrolado en benoitc hackney permite Inundación. El transporte SOCKS5 en src/hackney_socks5.erl aplica correctamente el tiempo de espera proporcionado por el llamador a la fase de negociación SOCKS5, pero luego actualiza la conexión a TLS usando la forma de dos argumentos ssl:connect/2, que por defecto tiene un tiempo de espera infinito. El valor de Timeout está en el ámbito en el sitio de la llamada pero no se reenvía. Un proxy SOCKS5 hostil que completa el handshake SOCKS5 normalmente y luego se queda en silencio (o envía un TLS ServerHello parcial y se detiene) hará que el proceso de conexión se bloquee indefinidamente, independientemente de las opciones connect_timeout o recv_timeout proporcionadas por el llamador.
Este problema afecta a hackney: desde 0.10.0 antes de 4.0.1.
Uncontrolled Resource Consumption vulnerability in benoitc hackney allows Flooding. The SOCKS5 transport in src/hackney_socks5.erl correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but then upgrades the connection to TLS using the two-argument form ssl:connect/2, which defaults to an infinite timeout. The Timeout value is in scope at the call site but is not forwarded. A hostile SOCKS5 proxy that completes the SOCKS5 handshake normally and then goes silent (or sends a partial TLS ServerHello and stalls) will cause the connecting process to block indefinitely, regardless of the connect_timeout or recv_timeout options supplied by the caller.
This issue affects hackney: from 0.10.0 before 4.0.1.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
