CRITICAL9.1

GHSA-r48q-9g5r-8q2h

Authorization Bypass Through User-Controlled Key in go-restful

Quick fix

GHSA-r48q-9g5r-8q2h — github.com/emicklei/go-restful/v3: upgrade to the fixed version with the command below.

go get github.com/emicklei/go-restful/v3@v3.8.0

Details

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/emicklei/go-restful/v3

Introduced in: 3.0.0Fixed in: 3.8.0

Fixgo get github.com/emicklei/go-restful/v3@v3.8.0

Go/github.com/emicklei/go-restful

Introduced in: 0Fixed in: 2.16.0

Fixgo get github.com/emicklei/go-restful@v2.16.0

Go/github.com/emicklei/go-restful/v2

Introduced in: 0

No fixed version published yet for github.com/emicklei/go-restful/v2 (go modules). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-1996[ADVISORY]
https://github.com/emicklei/go-restful/issues/489[WEB]
https://github.com/emicklei/go-restful/commit/926662532deb450272956c7bc573978464aae74e[WEB]
https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1[WEB]
https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10[WEB]
https://security.netapp.com/advisory/ntap-20220923-0005[WEB]
https://pkg.go.dev/vuln/GO-2022-0619[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3[WEB]
https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1[WEB]
https://github.com/emicklei/go-restful[PACKAGE]