Bug 2158262 (CVE-2017-20146)

Summary:	CVE-2017-20146 gorilla: Usage of the CORS handler may apply improper CORS headers
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abenaiss, amackenz, amasferr, amctagga, aoconnor, bbaude, bcoca, bdettelb, bkundu, bniver, chazlett, cwelton, davidn, dfreiber, dwalsh, dymurray, eglynn, ellin, epacific, etamir, flucifre, gmeno, gparvin, ibolton, jarrpa, jburrell, jcammara, jcantril, jchui, jhardy, jjoyce, jligon, jmatthew, jmontleo, jneedle, jnovy, jobarker, jwon, lball, lgamliel, lhh, lsm5, mabashia, madam, matzew, mbenjamin, mboddu, mburns, mfilanov, mgarciac, mhackett, mheon, mkudlej, muagarwa, mwringe, nbecker, njean, ocs-bugs, osapryki, owatkins, pahickey, periklis, pthomas, rfreiman, rgarg, rhos-maint, rhuss, rogbas, rrajasek, scorneli, shbose, simaishi, slucidi, smcdonal, sostapov, spower, sseago, stcannon, teagle, tjochec, tkral, tsweeney, ubhargav, umohnani, vereddy, vkumar, whayutin, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	github.com/gorilla/handlers 1.3.0	Doc Type:	---
Doc Text:	A flaw was found in Gorilla. Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-08 00:00:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2156768

Description Anten Skrabec 2023-01-04 20:08:08 UTC

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.

https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145
https://github.com/gorilla/handlers/pull/116
https://pkg.go.dev/vuln/GO-2020-0020

Comment 1 Product Security DevOps Team 2023-01-08 00:00:36 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-20146