Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package

高 7.5CVE-2022-2529 · GHSA-9rpw-2h95-666c · GO-2022-1032 · 30/09/2022 公開 · 17/06/2026 更新

要点

CVE-2022-2529 は github.com/cloudflare/goflow, github.com/cloudflare/goflow/v3, goflow (cloudflare) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.97%（全脆弱性の 61.9% より高い）。
対処：3.4.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/cloudflare/goflow Go	`全バージョン`	修正版なし
github.com/cloudflare/goflow/v3 Go	`< 3.4.4`	`3.4.4`
goflow cloudflare	`< 3.4.4`	`3.4.4`

概要

Impact

The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.

Specific Go Packages Affected

github.com/cloudflare/goflow/v3/decoders/sflow

Patches

Version 3.4.4 contains patches fixing this.

Workarounds

A possible workaround is to not have your goflow collector publicly reachable.

For more information

If you have any questions or comments about this advisory:

Open an issue in goflow repo
Email us netdev[@]cloudflare.com

NVD の説明

sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.