[GH-ISSUE #3410] SSL/TLS协议信息泄露漏洞(CVE-2016-2183)

gitea-mirror commented

2026-05-05 13:45:30 -06:00

Owner

Copy link

Originally created by @liupanhu on GitHub (Apr 14, 2023).
Original GitHub issue: https://github.com/fatedier/frp/issues/3410

Bug Description

版本 0.38.0
漏洞扫描发现上述问题。请问需要怎么解决。

frpc Version

0.38.0

frps Version

0.38.0

System Architecture

linux/amd64

Configurations

[common]
bind_addr = 0.0.0.0
bind_port = 7000
bind_udp_port = 7001
kcp_bind_port = 7000
vhost_http_port = 8080
vhost_https_port = 3443
dashboard_addr = 0.0.0.0
dashboard_port = 7500
dashboard_user = admin
dashboard_pwd = tokentokentoken
log_file = ./frps.log
log_level = info
log_max_days = 3
token = token
allow_ports = 2000-3000,3001,3003,4000-50000
max_pool_count = 5
max_ports_per_client = 0
subdomain_host = xx.xxxxx.com
tcp_mux = true

Logs

No response

Steps to reproduce

...

Affected area

Docs
Installation
Performance and Scalability
Security
User Experience
Test and Release
Developer Infrastructure
Client Plugin
Server Plugin
Extensions
Others

Originally created by @liupanhu on GitHub (Apr 14, 2023). Original GitHub issue: https://github.com/fatedier/frp/issues/3410 ### Bug Description ![image](https://user-images.githubusercontent.com/10653301/232010260-0246eada-5323-4108-8462-b978d312b483.png) 版本 0.38.0 漏洞扫描发现上述问题。请问需要怎么解决。 ### frpc Version 0.38.0 ### frps Version 0.38.0 ### System Architecture linux/amd64 ### Configurations [common] bind_addr = 0.0.0.0 bind_port = 7000 bind_udp_port = 7001 kcp_bind_port = 7000 vhost_http_port = 8080 vhost_https_port = 3443 dashboard_addr = 0.0.0.0 dashboard_port = 7500 dashboard_user = admin dashboard_pwd = tokentokentoken log_file = ./frps.log log_level = info log_max_days = 3 token = token allow_ports = 2000-3000,3001,3003,4000-50000 max_pool_count = 5 max_ports_per_client = 0 subdomain_host = xx.xxxxx.com tcp_mux = true ### Logs _No response_ ### Steps to reproduce 1. 2. 3. ... ### Affected area - [ ] Docs - [ ] Installation - [ ] Performance and Scalability - [X] Security - [ ] User Experience - [ ] Test and Release - [ ] Developer Infrastructure - [ ] Client Plugin - [ ] Server Plugin - [ ] Extensions - [ ] Others

gitea-mirror

2026-05-05 13:45:30 -06:00

closed this issue
added the
lifecycle/stale
label

gitea-mirror commented

2026-05-05 13:45:33 -06:00

Author

Owner

Copy link

@liupanhu commented on GitHub (Apr 14, 2023):

7000端口，客户端注册端口，被漏扫检测出问题。

@liupanhu commented on GitHub (Apr 14, 2023): 7000端口，客户端注册端口，被漏扫检测出问题。

gitea-mirror commented

2026-05-05 13:45:34 -06:00

Author

Owner

Copy link

@Becods commented on GitHub (Apr 15, 2023):

https://github.com/fatedier/frp/issues/3394

TLS 目前用是 golang 默认配置，默认不禁用 TLS 1.1。

可以考虑支持这个配置，来选择禁用的 TLS 版本，不过不确定禁用之后是不是会有兼容性问题。而且既然是 Golang 默认的行为，可能主要是出于兼容性的考虑，在大部分场景下应该都是可以接受的。

@Becods commented on GitHub (Apr 15, 2023): https://github.com/fatedier/frp/issues/3394 > TLS 目前用是 golang 默认配置，默认不禁用 TLS 1.1。 > > 可以考虑支持这个配置，来选择禁用的 TLS 版本，不过不确定禁用之后是不是会有兼容性问题。而且既然是 Golang 默认的行为，可能主要是出于兼容性的考虑，在大部分场景下应该都是可以接受的。

gitea-mirror commented

2026-05-05 13:45:35 -06:00

Author

Owner

Copy link

@github-actions[bot] commented on GitHub (May 16, 2023):

Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

@github-actions[bot] commented on GitHub (May 16, 2023): Issues go stale after 30d of inactivity. Stale issues rot after an additional 7d of inactivity and eventually close.

gitea-mirror referenced this issue

2026-05-05 14:45:27 -06:00

[PR #2729] [MERGED] add new sponsor #4614

gitea-mirror referenced this issue

2026-05-05 14:45:33 -06:00

[PR #2782] [MERGED] bump version #4622

No Branch/Tag specified