Exposure of client IP addresses in net/http

中 6.5CVE-2022-32148 · BIT-golang-2022-32148 · GO-2022-0520 · 10/08/2022 公開 · 17/06/2026 更新

要点

CVE-2022-32148 は stdlib, go (golang) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.5%（全脆弱性の 74.6% より高い）。
対処：1.18.4, 1.17.12 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
stdlib Go	`≥ 1.18.0-0, < 1.18.4< 1.17.12`	`1.18.41.17.12`
go golang	`≥ 1.18.0, < 1.18.4< 1.17.12`	`1.18.41.17.12`

概要

Client IP adresses may be unintentionally exposed via X-Forwarded-For headers.

When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy sets the client IP as the value of the X-Forwarded-For header, contrary to its documentation.

In the more usual case where a Director function sets the X-Forwarded-For header value to nil, ReverseProxy leaves the header unmodified as expected.

NVD の説明

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.