Bug 2094982 (CVE-2022-1996)
| Summary: | CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Anten Skrabec <askrabec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, adam.kaplan, admiller, adudiak, agarcial, akashem, amackenz, amasferr, amctagga, anpicker, aos-bugs, aos-network-edge-staff, aos-odin-bot, aos-team-ota, aputtur, bbennett, bcoca, bkundu, blaise, bmontgom, bradley.g.smith, bthurber, cdaley, charlie, chazlett, chousekn, cmeyers, cnv-qe-bugs, dagray, davide, davidn, dcadzow, dholler, dkenigsb, dperaza, dustymabe, dwalsh, dwest, eaguilar, ebakerupw, ebaron, eparis, etamir, fdeutsch, gblomqui, go-sig, ijolliff, jacding, jburrell, jcajka, jcammara, jcantril, jchui, jerzhang, jhadvig, jhardy, jhrozek, jitsingh, jkang, jmencak, jobarker, joelsmith, jokerman, jpallich, jwendell, jwon, lball, lbragsta, lhinds, lmeyer, mabashia, maszulik, matzew, maxwell, mfojtik, mkudlej, mrogers, nbecker, notting, nparekh, nstielau, obulatov, ocp-storage-bot, ocs-bugs, o.lemasle, openshift-release-oversight, oramraz, osapryki, oskutka, ovanders, pbunev, pegoncal, pehunt, phoracek, pjindal, rcernich, relrod, rfreiman, rhuss, rpetrell, rphillips, rrajasek, ryncsn, sanchezl, santiago, sdoran, sejug, sfroberg, sgott, slaznick, smcdonal, smullick, spandura, spasquie, sponnaga, stcannon, sttts, surbania, team-winc-bot, tfister, tjochec, tkuratom, tsedovic, tsweeney, twalsh, vkumar, wenshen, xiyuan, xxia, zebob.m |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | go-restful 3.8.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data on behalf of users.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-07 22:32:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2097967, 2097965, 2097966, 2097968, 2097969, 2097970, 2097971, 2097972, 2097973, 2097974, 2097975, 2097976, 2097977, 2097978, 2097979, 2097980, 2097981, 2097982, 2097983, 2097984, 2097987, 2097991, 2097992, 2097993, 2097994, 2097995, 2097996, 2097997, 2097998, 2097999, 2098000, 2098001, 2098002, 2098003, 2098005, 2098006, 2098007, 2098008, 2098009, 2098010, 2098011, 2098012, 2098013, 2098014, 2098015, 2098016, 2098017, 2098018, 2098019, 2098020, 2098021, 2098022, 2098023, 2098024, 2098025, 2098026, 2098027, 2098028, 2098030, 2098031, 2098032, 2098033, 2098034, 2098035, 2098036, 2098037, 2098038, 2098039, 2098040, 2098041, 2098042, 2098043, 2098044, 2098045, 2098046, 2098047, 2098524, 2098525, 2098526, 2098527, 2100750, 2128375, 2128378, 2128380, 2128402, 2128403, 2128404, 2128405, 2128406, 2128407, 2128408, 2128409 | ||
| Bug Blocks: | 2094985 | ||
|
Description
Anten Skrabec
2022-06-08 18:51:16 UTC
Created containerd tracking bugs for this issue: Affects: epel-7 [bug 2097966] Affects: fedora-all [bug 2097965] Created cri-o:1.19/cri-o tracking bugs for this issue: Affects: fedora-all [bug 2097968] Created cri-o:1.20/cri-o tracking bugs for this issue: Affects: fedora-all [bug 2097969] Created cri-o:1.21/cri-o tracking bugs for this issue: Affects: fedora-all [bug 2097970] Created cri-o:1.22/cri-o tracking bugs for this issue: Affects: fedora-all [bug 2097971] Created golang-github-emicklei-restful tracking bugs for this issue: Affects: fedora-all [bug 2097972] Created golang-github-emicklei-restful-swagger12 tracking bugs for this issue: Affects: fedora-all [bug 2097973] Created golang-github-tonistiigi-opentelemetry-contrib tracking bugs for this issue: Affects: fedora-all [bug 2097974] Created golang-helm-3 tracking bugs for this issue: Affects: fedora-all [bug 2097975] Created golang-k8s-apiextensions-apiserver tracking bugs for this issue: Affects: fedora-all [bug 2097976] Created golang-k8s-code-generator tracking bugs for this issue: Affects: fedora-all [bug 2097977] Created golang-k8s-kube-openapi tracking bugs for this issue: Affects: fedora-all [bug 2097978] Created golang-k8s-pod-security-admission tracking bugs for this issue: Affects: fedora-all [bug 2097979] Created golang-k8s-sample-apiserver tracking bugs for this issue: Affects: fedora-all [bug 2097980] Created golang-opentelemetry-contrib tracking bugs for this issue: Affects: fedora-all [bug 2097981] Created golang-opentelemetry-contrib-0.20 tracking bugs for this issue: Affects: fedora-all [bug 2097982] Created kompose tracking bugs for this issue: Affects: epel-7 [bug 2097967] Affects: fedora-all [bug 2097983] Created origin tracking bugs for this issue: Affects: fedora-all [bug 2097984] Created golang-k8s-kube-aggregator tracking bugs for this issue: Affects: fedora-all [bug 2097987] This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2022:6042 https://access.redhat.com/errata/RHSA-2022:6042 This issue has been addressed in the following products: Openshift Serveless 1.24 Via RHSA-2022:6040 https://access.redhat.com/errata/RHSA-2022:6040 This issue has been addressed in the following products: RHEL-8-CNV-4.10 Via RHSA-2022:6351 https://access.redhat.com/errata/RHSA-2022:6351 This issue has been addressed in the following products: RHEL-8-CNV-4.9 Via RHSA-2022:8609 https://access.redhat.com/errata/RHSA-2022:8609 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-1996 This issue has been addressed in the following products: Cryostat 2 on RHEL 8 Via RHSA-2023:0814 https://access.redhat.com/errata/RHSA-2023:0814 This issue has been addressed in the following products: Red Hat OpenShift GitOps 1.8 Via RHSA-2023:3229 https://access.redhat.com/errata/RHSA-2023:3229 This issue has been addressed in the following products: Red Hat OpenShift GitOps 1.9 Via RHSA-2023:3557 https://access.redhat.com/errata/RHSA-2023:3557 |