MEDIUM6.1
GHSA-733f-44f3-3frw
gopkg.in/macaron.v1 Open Redirect vulnerability
Quick fix
GHSA-733f-44f3-3frw — gopkg.in/macaron.v1: upgrade to the fixed version with the command below.
go get gopkg.in/macaron.v1@v1.3.7Details
macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-12666[ADVISORY]
- https://github.com/go-macaron/macaron/issues/198[WEB]
- https://github.com/go-macaron/macaron/issues/198#issuecomment-622885959[WEB]
- https://github.com/go-macaron/macaron/pull/199[WEB]
- https://github.com/go-macaron/macaron/pull/199/commits/6bd9385542f7133467ab7d09a5f28f7d5dc52af7[WEB]
- https://github.com/go-macaron/macaron/commit/addc7461c3a90a040e79aa75bfd245107a210245[WEB]
- https://github.com/go-macaron/macaron[PACKAGE]
- https://github.com/go-macaron/macaron/releases/tag/v1.3.7[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QEUOHRC4EN4WZ66EVFML2UCV7ZQ63XZ[WEB]
- https://pkg.go.dev/vuln/GO-2020-0039[WEB]