Bug 2203008 (CVE-2022-41722) - CVE-2022-41722 golang: path/filepath: path-filepath filepath.Clean path traversal
Summary: CVE-2022-41722 golang: path/filepath: path-filepath filepath.Clean path trave...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-41722
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2169910
TreeView+ depends on / blocked
 
Reported: 2023-05-11 03:54 UTC by Avinash Hanwate
Modified: 2024-04-15 11:52 UTC (History)
140 users (show)

Fixed In Version: Go 1.20.1, Go 1.19.6
Clone Of:
Environment:
Last Closed: 2023-05-31 01:13:36 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3304 0 None None None 2023-05-30 20:14:13 UTC
Red Hat Product Errata RHSA-2023:3366 0 None None None 2023-06-07 02:02:33 UTC

Description Avinash Hanwate 2023-05-11 03:54:58 UTC 
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".

https://pkg.go.dev/vuln/GO-2023-1568
https://go.dev/cl/468123
https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
https://go.dev/issue/57274
Comment 8 Tom Sweeney 2023-05-16 21:47:28 UTC 
What version of Go is this fixed in?  Also, I'm unable to get access to the embargoed CVE.  Can you please update the Fixed In Version field of this bug.
Comment 9 errata-xmlrpc 2023-05-30 20:14:06 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3304 https://access.redhat.com/errata/RHSA-2023:3304
Comment 10 Product Security DevOps Team 2023-05-31 01:13:29 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-41722
Comment 11 errata-xmlrpc 2023-06-07 02:02:26 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:3366 https://access.redhat.com/errata/RHSA-2023:3366
Comment 13 Nick Tait 2023-08-10 01:30:51 UTC 
Hey Tom, sorry for the delay. The fixed versions are Go 1.20.1 & Go 1.19.6
Comment 16 Anten Skrabec 2024-04-15 11:49:55 UTC 
removed openshift-golang-builder-container from affects to remove from CVE page (IBM is upset about it)

also set `openshift`, `cri-tools`, `cri-o`, `containernetworking-plugins` and `conmon` as not affected due to same reason as #comment15 (https://redhat.service-now.com/surl.do?n=INC2921226)
Note You need to log in before you can comment on or make changes to this bug.