CVE-2022-32190

Опубликовано: 13 сент. 2022

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

Ссылки

https://go.dev/cl/423514
Patch
Release Notes
https://go.dev/issue/54385
Issue Tracking
Patch
Vendor Advisory
https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
Mailing List
Third Party Advisory
https://pkg.go.dev/vuln/GO-2022-0988
Issue Tracking
Patch
Vendor Advisory
https://go.dev/cl/423514
Patch
Release Notes
https://go.dev/issue/54385
Issue Tracking
Patch
Vendor Advisory
https://groups.google.com/g/golang-announce/c/x49AQzIVX-s
Mailing List
Third Party Advisory
https://pkg.go.dev/vuln/GO-2022-0988
Issue Tracking
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:golang:go:1.19.0:-:*:*:*:*:*:*

cpe:2.3:a:golang:go:1.19.0:beta1:*:*:*:*:*:*

cpe:2.3:a:golang:go:1.19.0:rc1:*:*:*:*:*:*

cpe:2.3:a:golang:go:1.19.0:rc2:*:*:*:*:*:*

EPSS

Процентиль: 24%

0.00076

Низкий

7.5 High

CVSS3

Дефекты

CWE-22

Связанные уязвимости

CVE-2022-32190

CVSS3: 7.5

ubuntu

почти 3 года назад

CVE-2022-32190

CVSS3: 7.5

redhat

почти 3 года назад

CVE-2022-32190

CVSS3: 7.5

debian

почти 3 года назад

JoinPath and URL.JoinPath do not remove ../ path elements appended to ...

GHSA-q856-gh5w-3vwg

CVSS3: 9.8

github

почти 3 года назад

SUSE-SU-2022:3326-1

suse-cvrf

больше 2 лет назад

Security update for go1.19

EPSS

Процентиль: 24%

0.00076

Низкий

7.5 High

CVSS3

Дефекты

CWE-22