VDB
Sign up
HIGH7.5

GHSA-6983-jfq8-485w

Phoenix: Unbounded channel joins per transport enables DoS over few connections

Quick fix

GHSA-6983-jfq8-485w — phoenix: upgrade to the fixed version with the command below.

mix deps.update phoenix

Details

### Summary

Phoenix transports do not limit the number of channels in a given connection, making it easy to spawn hundreds of thousands of processes over a single connection, and, eventually reaching the max processes VM limit. The solution is to limit the number of channels per transport, so an attacker needs to start new HTTP/WebSocket connections, allowing third-party services to apply rate limits and intervene more easily.

### Impact

An unauthenticated remote attacker can cause a denial of service against any Phoenix app that exposes LongPoll/WebSocket transports.

Are you affected?

Enter the version of the package you're using.

Affected packages

Hex/phoenix
Introduced in: 0.11.0Fixed in: 1.5.15
Fixmix deps.update phoenix
Hex/phoenix
Introduced in: 1.6.0-rc.0Fixed in: 1.6.17
Fixmix deps.update phoenix
Hex/phoenix
Introduced in: 1.7.0-rc.0Fixed in: 1.7.24
Fixmix deps.update phoenix
Hex/phoenix
Introduced in: 1.8.0-rc.0Fixed in: 1.8.9
Fixmix deps.update phoenix

References