GO-2021-0052
Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2020-28483
- Alias
- GHSA-h395-qcrw-5vmq, SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736
Description
Due to improper HTTP header sanitization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · github.com/gin-gonic/gin | introduced 0, fixed 1.7.7 |
Références
- https://github.com/gin-gonic/gin/issues/2862 REPORT
- https://github.com/gin-gonic/gin/issues/2473 REPORT
- https://github.com/gin-gonic/gin/issues/2232 REPORT
- https://github.com/gin-gonic/gin/pull/2844 FIX
- https://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937 FIX
- https://github.com/gin-gonic/gin/pull/2632 FIX
- https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711 FIX
- https://github.com/gin-gonic/gin/pull/2675 FIX
- https://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9 FIX
- https://github.com/gin-gonic/gin/pull/2474 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |