Bug 2094982 (CVE-2022-1996) - CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key
Summary: CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled Key
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-1996
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2097965 2097966 2097967 2097968 2097969 2097970 2097971 2097972 2097973 2097974 2097975 2097976 2097977 2097978 2097979 2097980 2097981 2097982 2097983 2097984 2097987 2097991 2097992 2097993 2097994 2097995 2097996 2097997 2097998 2097999 2098000 2098001 2098002 2098003 2098005 2098006 2098007 2098008 2098009 2098010 2098011 2098012 2098013 2098014 2098015 2098016 2098017 2098018 2098019 2098020 2098021 2098022 2098023 2098024 2098025 2098026 2098027 2098028 2098030 2098031 2098032 2098033 2098034 2098035 2098036 2098037 2098038 2098039 2098040 2098041 2098042 2098043 2098044 2098045 2098046 2098047 2098524 2098525 2098526 2098527 2100750 2128375 2128378 2128380 2128402 2128403 2128404 2128405 2128406 2128407 2128408 2128409
Blocks: 2094985
TreeView+ depends on / blocked
 
Reported: 2022-06-08 18:51 UTC by Anten Skrabec
Modified: 2024-11-21 18:43 UTC (History)
171 users (show)

Fixed In Version: go-restful 3.8.0
Clone Of:
Environment:
Last Closed: 2022-12-07 22:32:46 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:6040 0 None None None 2022-08-10 13:15:51 UTC
Red Hat Product Errata RHSA-2022:6042 0 None None None 2022-08-10 11:37:14 UTC
Red Hat Product Errata RHSA-2022:6351 0 None None None 2022-09-06 14:01:58 UTC
Red Hat Product Errata RHSA-2022:8609 0 None None None 2022-11-22 17:46:59 UTC
Red Hat Product Errata RHSA-2023:0814 0 None None None 2023-02-20 12:41:14 UTC
Red Hat Product Errata RHSA-2023:3229 0 None None None 2023-05-18 15:52:03 UTC
Red Hat Product Errata RHSA-2023:3557 0 None None None 2023-06-09 15:39:04 UTC

Description Anten Skrabec 2022-06-08 18:51:16 UTC 
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1
https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10
Comment 2 Avinash Hanwate 2022-06-17 05:42:47 UTC 
Created containerd tracking bugs for this issue:

Affects: epel-7 [bug 2097966]
Affects: fedora-all [bug 2097965]


Created cri-o:1.19/cri-o tracking bugs for this issue:

Affects: fedora-all [bug 2097968]


Created cri-o:1.20/cri-o tracking bugs for this issue:

Affects: fedora-all [bug 2097969]


Created cri-o:1.21/cri-o tracking bugs for this issue:

Affects: fedora-all [bug 2097970]


Created cri-o:1.22/cri-o tracking bugs for this issue:

Affects: fedora-all [bug 2097971]


Created golang-github-emicklei-restful tracking bugs for this issue:

Affects: fedora-all [bug 2097972]


Created golang-github-emicklei-restful-swagger12 tracking bugs for this issue:

Affects: fedora-all [bug 2097973]


Created golang-github-tonistiigi-opentelemetry-contrib tracking bugs for this issue:

Affects: fedora-all [bug 2097974]


Created golang-helm-3 tracking bugs for this issue:

Affects: fedora-all [bug 2097975]


Created golang-k8s-apiextensions-apiserver tracking bugs for this issue:

Affects: fedora-all [bug 2097976]


Created golang-k8s-code-generator tracking bugs for this issue:

Affects: fedora-all [bug 2097977]


Created golang-k8s-kube-openapi tracking bugs for this issue:

Affects: fedora-all [bug 2097978]


Created golang-k8s-pod-security-admission tracking bugs for this issue:

Affects: fedora-all [bug 2097979]


Created golang-k8s-sample-apiserver tracking bugs for this issue:

Affects: fedora-all [bug 2097980]


Created golang-opentelemetry-contrib tracking bugs for this issue:

Affects: fedora-all [bug 2097981]


Created golang-opentelemetry-contrib-0.20 tracking bugs for this issue:

Affects: fedora-all [bug 2097982]


Created kompose tracking bugs for this issue:

Affects: epel-7 [bug 2097967]
Affects: fedora-all [bug 2097983]


Created origin tracking bugs for this issue:

Affects: fedora-all [bug 2097984]
Comment 3 Avinash Hanwate 2022-06-17 05:51:41 UTC 
Created golang-k8s-kube-aggregator tracking bugs for this issue:

Affects: fedora-all [bug 2097987]
Comment 14 errata-xmlrpc 2022-08-10 11:37:09 UTC 
This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2022:6042 https://access.redhat.com/errata/RHSA-2022:6042
Comment 15 errata-xmlrpc 2022-08-10 13:15:45 UTC 
This issue has been addressed in the following products:

  Openshift Serveless 1.24

Via RHSA-2022:6040 https://access.redhat.com/errata/RHSA-2022:6040
Comment 18 errata-xmlrpc 2022-09-06 14:01:51 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-4.10

Via RHSA-2022:6351 https://access.redhat.com/errata/RHSA-2022:6351
Comment 26 errata-xmlrpc 2022-11-22 17:46:54 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-4.9

Via RHSA-2022:8609 https://access.redhat.com/errata/RHSA-2022:8609
Comment 28 Product Security DevOps Team 2022-12-07 22:32:35 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-1996
Comment 30 errata-xmlrpc 2023-02-20 12:41:06 UTC 
This issue has been addressed in the following products:

  Cryostat 2 on RHEL 8

Via RHSA-2023:0814 https://access.redhat.com/errata/RHSA-2023:0814
Comment 32 errata-xmlrpc 2023-05-18 15:51:57 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.8

Via RHSA-2023:3229 https://access.redhat.com/errata/RHSA-2023:3229
Comment 33 errata-xmlrpc 2023-06-09 15:38:57 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.9

Via RHSA-2023:3557 https://access.redhat.com/errata/RHSA-2023:3557
Note You need to log in before you can comment on or make changes to this bug.