Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade aardvark-dnsUpgrade netavarkUpgrade golang-raceUpgrade grafana-pcpUpgrade criu-libsUpgrade golang-miscUpgrade oci-seccomp-bpf-hookUpgrade toolboxUpgrade grafanaUpgrade skopeo-testsUpgrade python3-podmanUpgrade libslirpUpgrade golangUpgrade slirp4netnsUpgrade go-toolsetUpgrade libslirp-develUpgrade git-lfsUpgrade conmonUpgrade containers-commonUpgrade golang-srcUpgrade criu-develUpgrade podman-gvproxyUpgrade python3-criuUpgrade buildah-testsUpgrade toolbox-testsUpgrade golang-docsUpgrade podman-testsUpgrade skopeoUpgrade podman-pluginsUpgrade runcUpgrade podman-remoteUpgrade golang-binUpgrade delveUpgrade containernetworking-pluginsUpgrade critUpgrade criuUpgrade container-selinuxUpgrade cockpit-podmanUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade golang-testsUpgrade udicaUpgrade podmanUpgrade crunUpgrade podman-catatonitUpgrade buildah | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-github-kr-pty-develUpgrade golang-docsUpgrade runcUpgrade golang-github-gorilla-context-develUpgrade golang-testsUpgrade go-rpm-templatesUpgrade golangUpgrade golang-binUpgrade go-srpm-macrosUpgrade golistUpgrade golang-raceUpgrade golang-github-godbus-dbus-develUpgrade go-rpm-macrosUpgrade golang-googlecode-net-develUpgrade golist-debuginfoUpgrade golang-github-gorilla-mux-develUpgrade golang-sharedUpgrade go-filesystemUpgrade golang-srcUpgrade runc-debuginfoUpgrade golang-googlecode-sqlite-develUpgrade golang-github-syndtr-gocapability-develUpgrade golang-misc | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-binUpgrade golang-sharedUpgrade golang-docsUpgrade golist-debuginfoUpgrade golang-github-cpuguy83-md2manUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-srcUpgrade golang-testsUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-raceUpgrade golist-debugsourceUpgrade golistUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-miscUpgrade golang | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade toolbox-debugsourceUpgrade delveUpgrade golang-miscUpgrade critUpgrade golang-binUpgrade criu-debugsourceUpgrade buildah-debugsourceUpgrade skopeoUpgrade conmon-debugsourceUpgrade grafana-pcpUpgrade podman-plugins-debuginfoUpgrade criu-libsUpgrade skopeo-testsUpgrade podman-pluginsUpgrade runc-debugsourceUpgrade slirp4netns-debugsourceUpgrade criuUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debuginfoUpgrade git-lfs-debuginfoUpgrade podman-catatonitUpgrade fuse-overlayfs-debugsourceUpgrade delve-debugsourceUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade golang-testsUpgrade podman-catatonit-debuginfoUpgrade golangUpgrade criu-develUpgrade podmanUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-tests-debuginfoUpgrade runcUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade crun-debugsourceUpgrade containers-commonUpgrade aardvark-dnsUpgrade golang-srcUpgrade podman-remoteUpgrade delve-debuginfoUpgrade libslirp-debuginfoUpgrade runc-debuginfoUpgrade golang-docsUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade python3-criuUpgrade grafanaUpgrade git-lfs-debugsourceUpgrade skopeo-debugsourceUpgrade golang-raceUpgrade buildah-testsUpgrade toolbox-testsUpgrade libslirp-debugsourceUpgrade cockpit-podmanUpgrade conmon-debuginfoUpgrade conmonUpgrade fuse-overlayfsUpgrade git-lfsUpgrade grafana-pcp-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade grafana-debuginfoUpgrade podman-gvproxyUpgrade udicaUpgrade skopeo-debuginfoUpgrade python3-podmanUpgrade libslirpUpgrade go-toolsetUpgrade container-selinuxUpgrade toolboxUpgrade slirp4netnsUpgrade podman-testsUpgrade netavarkUpgrade crun-debuginfoUpgrade buildahUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfo | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade criu-libsUpgrade libslirp-develUpgrade git-lfsUpgrade crunUpgrade go-toolsetUpgrade grafana-pcpUpgrade conmonUpgrade container-selinuxUpgrade criu-develUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade python3-criuUpgrade podman-pluginsUpgrade containers-commonUpgrade skopeo-testsUpgrade grafanaUpgrade podman-catatonitUpgrade skopeoUpgrade slirp4netnsUpgrade golang-binUpgrade udicaUpgrade buildahUpgrade golang-raceUpgrade golang-testsUpgrade podman-testsUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade criuUpgrade golangUpgrade runcUpgrade podman-remoteUpgrade netavarkUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade podmanUpgrade golang-srcUpgrade buildah-testsUpgrade critUpgrade python3-podmanUpgrade golang-docsUpgrade golang-miscUpgrade libslirp | Aug 4, 2022 | Jul 12, 2022 |
| Redhat Openshift | — | Upgrade cri-oUpgrade cri-toolsUpgrade ignition | Nov 29, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade container-selinuxUpgrade toolboxUpgrade golang-srcUpgrade skopeoUpgrade crunUpgrade criu-develUpgrade delveUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python3-podmanUpgrade delve-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade runc-debuginfoUpgrade git-lfs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade crun-debugsourceUpgrade grafana-pcpUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade delve-debugsourceUpgrade toolbox-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-debuginfoUpgrade podman-pluginsUpgrade golang-raceUpgrade libslirp-develUpgrade skopeo-testsUpgrade containers-commonUpgrade git-lfsUpgrade podmanUpgrade golang-testsUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade grafanaUpgrade podman-remote-debuginfoUpgrade libslirp-debugsourceUpgrade podman-catatonit-debuginfoUpgrade golang-binUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade grafana-debuginfoUpgrade buildah-debuginfoUpgrade conmon-debugsourceUpgrade skopeo-debugsourceUpgrade git-lfs-debugsourceUpgrade go-toolsetUpgrade podman-catatonitUpgrade critUpgrade buildah-testsUpgrade golang-docsUpgrade conmonUpgrade python3-criuUpgrade golangUpgrade criu-debugsourceNo solution existsUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade netavarkUpgrade criu-debuginfoUpgrade criuUpgrade buildah-tests-debuginfoUpgrade conmon-debuginfoUpgrade podman-gvproxyUpgrade libslirpUpgrade buildahUpgrade fuse-overlayfsUpgrade podman-testsUpgrade grafana-pcp-debuginfoUpgrade cockpit-podmanUpgrade skopeo-debuginfoUpgrade udicaUpgrade runcUpgrade golang-miscUpgrade toolbox-testsUpgrade podman-dockerUpgrade runc-debugsourceUpgrade crun-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade libslirpUpgrade golang-raceUpgrade grafana-pcp-debuginfoUpgrade podman-plugins-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade crunUpgrade buildah-testsUpgrade skopeo-debuginfoUpgrade podman-debugsourceUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade podman-testsUpgrade buildahUpgrade grafanaUpgrade git-lfsUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade git-lfs-debugsourceUpgrade libslirp-debugsourceUpgrade go-toolsetUpgrade toolbox-testsUpgrade criu-debugsourceUpgrade containernetworking-pluginsUpgrade delveUpgrade crun-debugsourceUpgrade critUpgrade fuse-overlayfsUpgrade slirp4netns-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade delve-debuginfoUpgrade criuUpgrade python3-criuUpgrade skopeo-testsUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-debuginfoUpgrade criu-debuginfoUpgrade git-lfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirp-debuginfoUpgrade grafana-pcpUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade libslirp-develUpgrade golangUpgrade runcUpgrade podman-remoteUpgrade criu-libsUpgrade toolboxUpgrade golang-binUpgrade toolbox-debuginfoUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade toolbox-debugsourceUpgrade delve-debugsourceUpgrade podman-remote-debuginfoUpgrade criu-develUpgrade buildah-debugsourceUpgrade podman-pluginsUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade grafana-debuginfo | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.18-docUpgrade go1.17-docUpgrade go1.17Upgrade go1.17-raceUpgrade go1.18-openssl-raceUpgrade go1.18Upgrade go1.18-openssl-docUpgrade go1.18-opensslUpgrade go1.18-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.13Upgrade golang-1.16-goUpgrade golang-1.18 | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub