golang go http请求的解释不一致性（http请求私运）

admin

0
文章

0
评论

2023-11-30 05:34:32 Ali_nvd 来源：ZONE.CI 全球网 0 阅读模式

中危 golang go http请求的解释不一致性（http请求私运）

CVE编号

CVE-2022-2880

利用情况

暂无

补丁情况

官方补丁

披露时间

2022-10-14

漏洞描述

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://go.dev/cl/432976
https://go.dev/issue/54663
https://groups.google.com/g/golang-announce/c/xtuG5faxtaU
https://pkg.go.dev/vuln/GO-2022-1038
https://security.gentoo.org/glsa/202311-09

受影响软件情况

1
#	类型	厂商	产品	版本	影响面
	运行在以下环境
	应用	golang	go	*		Up to (excluding) 1.18.7
	运行在以下环境
	应用	golang	go	*	From (including) 1.19.0	Up to (excluding) 1.19.2
	运行在以下环境
	系统	alpine_3.16	go	*		Up to (excluding) 1.18.7-r0
	运行在以下环境
	系统	alpine_3.17	go	*		Up to (excluding) 1.19.2-r0
	运行在以下环境
	系统	alpine_3.18	go	*		Up to (excluding) 1.19.2-r0
	运行在以下环境
	系统	alpine_edge	go	*		Up to (excluding) 1.19.2-r0
	运行在以下环境
	系统	amazon_2	golang	*		Up to (excluding) 1.18.9-1.amzn2.0.2
	运行在以下环境
	系统	amazon_2022	lua	*		Up to (excluding) 5.4.4-3.amzn2022.0.1
	运行在以下环境
	系统	amazon_2023	golang	*		Up to (excluding) 1.19.8-1.amzn2023.0.1
	运行在以下环境
	系统	anolis_os_8	grafana	*		Up to (excluding) 76-2.0.1
	运行在以下环境
	系统	centos_8	grafana-debuginfo	*		Up to (excluding) 75-1.el8
	运行在以下环境
	系统	debian_10	golang-1.11	*		Up to (including) 1.11.6-1+deb10u4
	运行在以下环境
	系统	debian_11	golang-1.15	*		Up to (including) 1.15.15-1~deb11u4
	运行在以下环境
	系统	debian_12	golang-1.19	*		Up to (excluding) 1.19.2-1
	运行在以下环境
	系统	debian_sid	golang-1.19	*		Up to (excluding) 1.19.2-1
	运行在以下环境
	系统	fedora_35	lua-devel	*		Up to (excluding) 5.4.4-3.fc35
	运行在以下环境
	系统	fedora_36	lua-devel	*		Up to (excluding) 5.4.4-3.fc36
	运行在以下环境
	系统	fedora_37	golang-tests	*		Up to (excluding) 1.19.2-1.fc37
	运行在以下环境
	系统	fedora_EPEL_7	golang-race	*		Up to (excluding) 1.18.9-1.el7
	运行在以下环境
	系统	opensuse_Leap_15.3	go1.18-race	*		Up to (excluding) 1.19.2-150000.1.12.1
	运行在以下环境
	系统	opensuse_Leap_15.4	go1.18-race	*		Up to (excluding) 1.18.10.1-150000.1.9.1
	运行在以下环境
	系统	opensuse_Leap_15.5	go1.18-openssl	*		Up to (excluding) 1.18.10.1-150000.1.9.1
	运行在以下环境
	系统	oracle_8	oraclelinux-release	*		Up to (excluding) 35.9-2.el8
	运行在以下环境
	系统	oracle_9	oraclelinux-release	*		Up to (excluding) 81-1.el9
	运行在以下环境
	系统	redhat_8	grafana-debuginfo	*		Up to (excluding) 75-1.el8
	运行在以下环境
	系统	redhat_9	grafana-debugsource	*		Up to (excluding) 45-1.el9_2
	运行在以下环境
	系统	ubuntu_18.04	golang-1.18	*		Up to (excluding) 1.18.1-1ubuntu1~18.04.4
	运行在以下环境
	系统	ubuntu_20.04	golang-1.18	*		Up to (excluding) 1.18.1-1ubuntu1~20.04.2
	运行在以下环境
	系统	ubuntu_22.04	golang-1.18	*		Up to (excluding) 1.18.1-1ubuntu1.1
	运行在以下环境
	系统	unionos_a	git-lfs	*		Up to (excluding) osbuild-composer-75-1.uelc20.01
	运行在以下环境
	系统	unionos_e	golang	*		Up to (excluding) 1.15.7-21.up1.uel20