CVE-2021-23409: 
Linux Debian vulnerability analysis and mitigation

The vulnerability CVE-2021-23409 affects the package github.com/pires/go-proxyproto before version 0.6.0. This vulnerability was discovered in January 2021 and publicly disclosed on July 12, 2021. The affected package is a Go library implementation of the PROXY protocol, versions 1 and 2 (Snyk).

The vulnerability is classified as a Denial of Service (DoS) issue with a CVSS v3.1 base score of 7.5 (High). The vulnerability allows attackers to create connections without the proxy protocol header, which could lead to the server holding socket descriptors open indefinitely. The attack vector is network-accessible (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), and has an unchanged scope (S:U) (NVD, Snyk).

The vulnerability can result in a total loss of availability, where attackers can fully deny access to resources in the impacted component. The impact is particularly severe as it can lead to the server running out of resources by holding socket descriptors open indefinitely (Snyk).

The vulnerability is exploitable over the network with low complexity and requires no special privileges or user interaction. The EPSS score indicates a 0.25% (65th percentile) probability of exploitation in the wild (Snyk).

The vulnerability was fixed in version 0.6.0 of the package. The solution implements a read deadline when waiting for the PROXY protocol header, preventing malicious clients from holding connections open indefinitely. Users should upgrade to version 0.6.0 or higher to mitigate this vulnerability (GitHub Release).