CVE-2022-32148: falha de média gravidade em Go standard library net/http
Exposure of client IP addresses in net/http
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 1.5%
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
Go standard library · net/httpCVEs relacionadas — Go standard library net/http
No mesmo produto, das mais perigosas para as menos.
CVE-2023-45288HIGHHTTP/2 CONTINUATION flood in net/httpEPSS 89.5%CVE-2022-41717—Excessive memory growth in net/http and golang.org/x/net/http2EPSS 6.1%CVE-2022-41723HIGHDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netEPSS 4.6%CVE-2023-39325—HTTP/2 rapid reset can cause excessive work in net/httpEPSS 3.8%CVE-2026-39821CRITICALInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaEPSS 1.8%CVE-2022-1705MEDIUMImproper sanitization of Transfer-Encoding headers in net/httpEPSS 1.5%