Gin's default logger allows unsanitized input that can allow remote attackers to inject arbitrary log lines

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-36567 · ADVISORY
• gin-gonic/gin#2237 · WEB
• gin-gonic/gin commit a71af9c · WEB
• gin-gonic/gin · PACKAGE
• pkg.go.dev/vuln/GO-2020-0001 · WEB

github.com/gin-gonic/gin のその他の脆弱性

• CVE-2019-25211緊急 9.1parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.com…
• CVE-2023-29401中 4.3The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Conten…
• CVE-2023-26125高 7.3Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a s…
• CVE-2020-28483高 7.1This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by…