Bug 2107383 (CVE-2022-32148)

Summary:	CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abishop, acui, adam.kaplan, admiller, adudiak, agarcial, agerstmayr, akashem, akostadi, akoutsou, alcohan, amackenz, amasferr, amctagga, amurdaca, andrew.jeddeloh, anjoseph, ansmith, aoconnor, aos-network-edge-staff, aos-odin-bot, aputtur, asm, athoscribeiro, aveerama, bbaude, bcl, bcoca, bdettelb, bgilbert, bkundu, blaise, bmontgom, bniver, bodavis, bperkins, bradley.g.smith, brking, bthurber, carl, cbartlet, cdaley, chazlett, chousekn, cmarinea, cmeyers, code, container-sig, crizzo, davide, davidn, dbenoit, debarshir, deparker, dfreiber, dhanak, dmayorov, doconnor, dornelas, dperaza, drosa, drow, dschmidt, dsimansk, dustymabe, dwalsh, dwd, dwest, dwhatley, dymurray, ebakerupw, eclipseo, eduardo.ramalho, eglynn, emachado, eparis, erezende, ericedens, extras-orphan, fdeutsch, filbranden, fjansen, flucifre, gblomqui, gchamoul, gmeno, go-sig, gparvin, grafana-maint, groman, gscrivan, haoli, hhorak, hkataria, ibolton, ijolliff, infra-sig, jacding, jaharrin, jajackso, jbalunas, jburrell, jcajka, jcammara, jcantril, jchaloup, jchui, jeder, jhadvig, jhardy, jhrozek, jitsingh, jjoyce, jlanda, jligon, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jnovy, jobarker, joelsmith, jonathan, jorton, jpadman, jprabhak, jramanat, jschluet, jwendell, jwon, kegrant, kingland, koliveir, kshier, ktokunaga.mail, kverlaen, kwalker, lacypret, lball, lbragsta, lchilton, lemenkov, lhh, lmeyer, lsm5, lsvaty, mabashia, maciek.borzecki, manissin, mark.e.fuller, mattia.verga, matzew, maxwell, mbenjamin, mburns, mcressma, me, me, mfojtik, mgarciac, mgoodwin, mhackett, mheon, miabbott, michel, mkudlej, mmakovy, mnewsome, mnovotny, mrussell, mskalicky, mwringe, nathans, ngompa13, njean, nobody, notting, nparekh, nstielau, n.yaghoobi.s, obudai, obulatov, ocp-storage-bot, ocs-bugs, o.lemasle, omaciel, openshift-release-oversight, opohorel, oramraz, osapryki, osbuilders, oskutka, owatkins, pahickey, pakotvan, pantinor, patrick, pbraun, pegoncal, peholase, pehunt, periklis, pgaikwad, pgrist, pjindal, pkubat, ploffay, pthomas, quantum.analyst, rcernich, redhat, relrod, rhaigner, rh.container.bot, rhcos-sst, rhcos-triage, rhuss, rjohnson, rojacob, rpetrell, rphillips, ryncsn, sanchezl, santiago, saroy, sausingh, scorneli, sdoran, sejug, sfeifer, sgott, shvarugh, simaishi, sipoyare, skontopo, skunkerk, slaznick, slucidi, smcdonal, smullick, sostapov, spandura, sponnaga, spower, spresti, sseago, ssteinbe, stcannon, stirabos, strigazi, surbania, teagle, team-winc-bot, tfister, tgunders, thason, thavo, thrcka, tjochec, tkuratom, travier, tsedmik, tsedovic, tstellar, tsweeney, twalsh, umohnani, user-cont-team+packit-fas, vereddy, vkumar, walters, wenshen, whayutin, wtam, xiyuan, xxia, yguenane, yselkowi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	golang 1.18.4, golang 1.17.12	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-17 00:33:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2107384, 2109914, 2109915, 2109916, 2109917, 2110276, 2110286, 2111001, 2111496, 2111746, 2111747, 2111752, 2111753, 2111758, 2111759, 2111760, 2111765, 2111766, 2111767, 2111782, 2111783, 2111786, 2111796, 2111797, 2111798, 2111805, 2111806, 2111807, 2111808, 2111816, 2111821, 2111822, 2111823, 2112009, 2112010, 2118635, 2118636, 2118637, 2118638, 2118640, 2119857, 2119858, 2119859, 2119860, 2119861, 2120621, 2120622, 2123509, 2123510, 2123514, 2123748, 2123750, 2123754, 2134423, 2134424
Bug Blocks:	2108714

Description Anten Skrabec 2022-07-14 21:21:24 UTC

When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.

Comment 1 Anten Skrabec 2022-07-14 21:21:39 UTC

Created golang tracking bugs for this issue:

Affects: fedora-all [bug 2107384]

Comment 6 Avinash Hanwate 2022-07-25 06:41:47 UTC

Created golang tracking bugs for this issue:

Affects: epel-all [bug 2110286]

Comment 24 errata-xmlrpc 2022-08-01 12:04:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:5775 https://access.redhat.com/errata/RHSA-2022:5775

Comment 25 errata-xmlrpc 2022-08-01 16:04:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:5799 https://access.redhat.com/errata/RHSA-2022:5799

Comment 26 errata-xmlrpc 2022-08-02 09:53:53 UTC

This issue has been addressed in the following products:

  Red Hat Developer Tools

Via RHSA-2022:5866 https://access.redhat.com/errata/RHSA-2022:5866

Comment 27 errata-xmlrpc 2022-08-10 11:37:46 UTC

This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2022:6042 https://access.redhat.com/errata/RHSA-2022:6042

Comment 28 errata-xmlrpc 2022-08-10 13:16:43 UTC

This issue has been addressed in the following products:

  Openshift Serveless 1.24

Via RHSA-2022:6040 https://access.redhat.com/errata/RHSA-2022:6040

Comment 32 errata-xmlrpc 2022-08-18 15:11:15 UTC

This issue has been addressed in the following products:

  Application Interconnect 1 for RHEL 8

Via RHSA-2022:6113 https://access.redhat.com/errata/RHSA-2022:6113

Comment 35 errata-xmlrpc 2022-08-25 11:21:41 UTC

This issue has been addressed in the following products:

  Node Maintenance Operator 4.11 for RHEL 8

Via RHSA-2022:6188 https://access.redhat.com/errata/RHSA-2022:6188

Comment 36 errata-xmlrpc 2022-09-01 05:41:37 UTC

This issue has been addressed in the following products:

  OSSO-1.1-RHEL-8

Via RHSA-2022:6152 https://access.redhat.com/errata/RHSA-2022:6152

Comment 37 errata-xmlrpc 2022-09-06 12:59:14 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2022:6347 https://access.redhat.com/errata/RHSA-2022:6347

Comment 38 errata-xmlrpc 2022-09-06 13:03:20 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2022:6346 https://access.redhat.com/errata/RHSA-2022:6346

Comment 39 errata-xmlrpc 2022-09-06 13:32:58 UTC

This issue has been addressed in the following products:

  Logging subsystem for Red Hat OpenShift 5.4

Via RHSA-2022:6183 https://access.redhat.com/errata/RHSA-2022:6183

Comment 40 errata-xmlrpc 2022-09-06 13:43:30 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8

Via RHSA-2022:6348 https://access.redhat.com/errata/RHSA-2022:6348

Comment 41 errata-xmlrpc 2022-09-06 14:34:54 UTC

This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.1 for RHEL 8

Via RHSA-2022:6345 https://access.redhat.com/errata/RHSA-2022:6345

Comment 42 errata-xmlrpc 2022-09-06 17:01:06 UTC

This issue has been addressed in the following products:

  RHOL-5.5-RHEL-8

Via RHSA-2022:6344 https://access.redhat.com/errata/RHSA-2022:6344

Comment 43 errata-xmlrpc 2022-09-06 22:30:16 UTC

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8

Via RHSA-2022:6370 https://access.redhat.com/errata/RHSA-2022:6370

Comment 44 errata-xmlrpc 2022-09-13 02:10:41 UTC

This issue has been addressed in the following products:

  OADP-1.0-RHEL-8

Via RHSA-2022:6430 https://access.redhat.com/errata/RHSA-2022:6430

Comment 48 errata-xmlrpc 2022-10-25 09:31:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7129 https://access.redhat.com/errata/RHSA-2022:7129

Comment 52 errata-xmlrpc 2022-11-08 09:24:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7519 https://access.redhat.com/errata/RHSA-2022:7519

Comment 53 errata-xmlrpc 2022-11-08 09:29:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7529 https://access.redhat.com/errata/RHSA-2022:7529

Comment 54 errata-xmlrpc 2022-11-08 10:00:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7648 https://access.redhat.com/errata/RHSA-2022:7648

Comment 55 errata-xmlrpc 2022-11-15 10:07:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8057 https://access.redhat.com/errata/RHSA-2022:8057

Comment 56 errata-xmlrpc 2022-11-15 10:44:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8250 https://access.redhat.com/errata/RHSA-2022:8250

Comment 61 errata-xmlrpc 2022-11-28 20:43:39 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11
  Ironic content for Red Hat OpenShift Container Platform 4.11

Via RHSA-2022:8626 https://access.redhat.com/errata/RHSA-2022:8626

Comment 63 errata-xmlrpc 2022-12-15 01:58:05 UTC

This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2022:9047 https://access.redhat.com/errata/RHSA-2022:9047

Comment 83 errata-xmlrpc 2023-01-17 14:51:06 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2022:7398 https://access.redhat.com/errata/RHSA-2022:7398

Comment 84 errata-xmlrpc 2023-01-17 19:37:10 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2022:7399 https://access.redhat.com/errata/RHSA-2022:7399

Comment 85 errata-xmlrpc 2023-01-24 12:49:38 UTC

This issue has been addressed in the following products:

  RHEL-8-CNV-4.12
  RHEL-7-CNV-4.12

Via RHSA-2023:0407 https://access.redhat.com/errata/RHSA-2023:0407

Comment 86 errata-xmlrpc 2023-01-24 13:35:25 UTC

This issue has been addressed in the following products:

  RHEL-8-CNV-4.12

Via RHSA-2023:0408 https://access.redhat.com/errata/RHSA-2023:0408

Comment 96 errata-xmlrpc 2023-03-06 18:39:44 UTC

This issue has been addressed in the following products:

  OpenShift Custom Metrics Autoscaler 2

Via RHSA-2023:1042 https://access.redhat.com/errata/RHSA-2023:1042

Comment 99 errata-xmlrpc 2023-03-15 19:55:34 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1
  Red Hat OpenStack Platform 16.2

Via RHSA-2023:1275 https://access.redhat.com/errata/RHSA-2023:1275

Comment 101 errata-xmlrpc 2023-05-09 07:34:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2357 https://access.redhat.com/errata/RHSA-2023:2357

Comment 103 errata-xmlrpc 2023-05-16 08:08:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2758 https://access.redhat.com/errata/RHSA-2023:2758

Comment 104 errata-xmlrpc 2023-05-16 08:13:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2802 https://access.redhat.com/errata/RHSA-2023:2802

Comment 106 Product Security DevOps Team 2023-05-17 00:33:29 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-32148

Comment 107 errata-xmlrpc 2023-06-15 16:00:21 UTC

This issue has been addressed in the following products:

  Red Hat Ceph Storage 6.1

Via RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642

Comment 109 errata-xmlrpc 2023-06-19 10:33:02 UTC

This issue has been addressed in the following products:

  OpenShift Developer Tools and Services for OCP 4.11

Via RHSA-2023:3664 https://access.redhat.com/errata/RHSA-2023:3664