Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-testsUpgrade golang-binUpgrade udicaUpgrade python3-criuUpgrade buildah-testsUpgrade podman-remoteUpgrade runcUpgrade containernetworking-pluginsUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade buildahUpgrade crunUpgrade podmanUpgrade criuUpgrade podman-testsUpgrade skopeoUpgrade delveUpgrade golang-docsUpgrade critUpgrade podman-catatonitUpgrade container-selinuxUpgrade toolbox-testsUpgrade cockpit-podmanUpgrade podman-dockerUpgrade golang-raceUpgrade libslirpUpgrade criu-develUpgrade skopeo-testsUpgrade slirp4netnsUpgrade containers-commonUpgrade toolboxUpgrade libslirp-develUpgrade golang-srcUpgrade python3-podmanUpgrade criu-libsUpgrade grafanaUpgrade grafana-pcpUpgrade git-lfsUpgrade podman-gvproxyUpgrade golangUpgrade netavarkUpgrade golang-miscUpgrade conmonUpgrade aardvark-dnsUpgrade oci-seccomp-bpf-hookUpgrade go-toolset | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-github-kr-pty-develUpgrade golang-testsUpgrade golangUpgrade go-rpm-templatesUpgrade golang-binUpgrade runcUpgrade golang-github-gorilla-context-develUpgrade go-srpm-macrosUpgrade golang-github-godbus-dbus-develUpgrade golang-github-gorilla-mux-develUpgrade golang-srcUpgrade golang-raceUpgrade golang-googlecode-net-develUpgrade golang-sharedUpgrade golist-debuginfoUpgrade go-filesystemUpgrade golang-miscUpgrade runc-debuginfoUpgrade golang-github-syndtr-gocapability-develUpgrade golang-googlecode-sqlite-develUpgrade golistUpgrade go-rpm-macros | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-binUpgrade golang-sharedUpgrade golang-github-cpuguy83-md2manUpgrade golang-docsUpgrade golist-debuginfoUpgrade golang-testsUpgrade golangUpgrade golist-debugsourceUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-raceUpgrade golistUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-miscUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-src | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade git-lfsUpgrade python3-podmanUpgrade toolboxUpgrade container-selinuxUpgrade go-toolsetUpgrade libslirpUpgrade podman-gvproxyUpgrade skopeo-debuginfoUpgrade toolbox-testsUpgrade udicaUpgrade grafana-debuginfoUpgrade cockpit-podmanUpgrade libslirp-debugsourceUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade git-lfs-debugsourceUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade podman-testsUpgrade slirp4netnsUpgrade netavarkUpgrade buildahUpgrade buildah-testsUpgrade skopeo-debugsourceUpgrade crun-debuginfoUpgrade grafana-pcp-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade grafanaUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crunUpgrade golang-raceUpgrade delve-debugsourceUpgrade podman-remoteUpgrade golangUpgrade buildah-tests-debuginfoUpgrade podman-catatonit-debuginfoUpgrade python3-criuUpgrade podman-remote-debuginfoUpgrade golang-srcUpgrade golang-docsUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade skopeo-testsUpgrade podmanUpgrade runcUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade crun-debugsourceUpgrade criu-develUpgrade slirp4netns-debuginfoUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade criu-debuginfoUpgrade conmon-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade buildah-debugsourceUpgrade git-lfs-debuginfoUpgrade grafana-pcpUpgrade runc-debugsourceUpgrade podman-pluginsUpgrade criu-libsUpgrade criu-debugsourceUpgrade podman-plugins-debuginfoUpgrade skopeoUpgrade criu-libs-debuginfoUpgrade criuUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade golang-miscUpgrade libslirp-develUpgrade golang-binUpgrade delveUpgrade critUpgrade containers-commonUpgrade aardvark-dnsUpgrade toolbox-debugsourceUpgrade buildah-debuginfoUpgrade golang-testsUpgrade runc-debuginfo | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade podman-catatonitUpgrade podman-remoteUpgrade netavarkUpgrade buildahUpgrade fuse-overlayfsUpgrade udicaUpgrade libslirpUpgrade golang-miscUpgrade golang-testsUpgrade runcUpgrade golangUpgrade buildah-testsUpgrade cockpit-podmanUpgrade golang-raceUpgrade podman-testsUpgrade criuUpgrade golang-binUpgrade slirp4netnsUpgrade podman-dockerUpgrade golang-srcUpgrade aardvark-dnsUpgrade podmanUpgrade containernetworking-pluginsUpgrade skopeoUpgrade golang-docsUpgrade podman-gvproxyUpgrade python3-podmanUpgrade critUpgrade libslirp-develUpgrade go-toolsetUpgrade grafana-pcpUpgrade conmonUpgrade criu-libsUpgrade criu-develUpgrade git-lfsUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade container-selinuxUpgrade grafanaUpgrade skopeo-testsUpgrade containers-commonUpgrade python3-criuUpgrade delve | Aug 4, 2022 | Jul 12, 2022 |
| Redhat Openshift | — | Upgrade cri-toolsUpgrade ignitionUpgrade cri-o | Nov 29, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade runc-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade container-selinuxUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade git-lfs-debuginfoUpgrade libslirp-debugsourceUpgrade golang-srcUpgrade podman-remoteUpgrade podman-plugins-debuginfoUpgrade podman-pluginsUpgrade fuse-overlayfs-debugsourceUpgrade delve-debuginfoUpgrade podman-catatonit-debuginfoUpgrade python3-podmanUpgrade golang-binUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade delveUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade delve-debugsourceUpgrade slirp4netns-debugsourceUpgrade toolboxUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade golang-raceUpgrade toolbox-debuginfoUpgrade grafana-pcpUpgrade crun-debugsourceUpgrade skopeoUpgrade criu-develUpgrade crunUpgrade git-lfsUpgrade golang-testsUpgrade criu-libsUpgrade podmanUpgrade grafanaUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade grafana-pcp-debuginfoUpgrade criu-debuginfoUpgrade podman-testsUpgrade fuse-overlayfsUpgrade buildah-debuginfoUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade toolbox-testsNo solution existsUpgrade conmon-debuginfoUpgrade buildahUpgrade critUpgrade skopeo-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade git-lfs-debugsourceUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade toolbox-debugsourceUpgrade go-toolsetUpgrade podman-catatonitUpgrade golang-docsUpgrade buildah-testsUpgrade criuUpgrade aardvark-dnsUpgrade conmonUpgrade netavarkUpgrade python3-criuUpgrade golangUpgrade podman-gvproxyUpgrade criu-libs-debuginfoUpgrade libslirpUpgrade grafana-debuginfoUpgrade cockpit-podmanUpgrade udicaUpgrade golang-miscUpgrade skopeo-debuginfoUpgrade runcUpgrade criu-debugsourceUpgrade podman-dockerUpgrade crun-debuginfo | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade conmonUpgrade git-lfsUpgrade conmon-debuginfoUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade git-lfs-debugsourceUpgrade toolbox-testsUpgrade golang-raceUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade buildah-testsUpgrade crun-debuginfoUpgrade podman-testsUpgrade skopeo-debugsourceUpgrade buildahUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade crunUpgrade slirp4netns-debuginfoUpgrade grafanaUpgrade podman-debugsourceUpgrade libslirpUpgrade grafana-pcp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade skopeoUpgrade crun-debugsourceUpgrade criu-libsUpgrade fuse-overlayfs-debugsourceUpgrade runcUpgrade conmon-debugsourceUpgrade toolbox-debugsourceUpgrade golangUpgrade criu-libs-debuginfoUpgrade containernetworking-pluginsUpgrade podman-debuginfoUpgrade podmanUpgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade libslirp-debuginfoUpgrade grafana-debuginfoUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade critUpgrade grafana-pcpUpgrade containers-commonUpgrade delve-debugsourceUpgrade criu-develUpgrade buildah-debugsourceUpgrade criu-debugsourceUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfoUpgrade delve-debuginfoUpgrade fuse-overlayfsUpgrade criuUpgrade buildah-tests-debuginfoUpgrade python3-criuUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade criu-debuginfoUpgrade podman-catatonit-debuginfoUpgrade git-lfs-debuginfoUpgrade toolbox-debuginfoUpgrade golang-binUpgrade toolbox | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 8.1.14 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.18-opensslUpgrade go1.18Upgrade go1.18-raceUpgrade go1.18-openssl-docUpgrade go1.18-openssl-raceUpgrade go1.17-raceUpgrade go1.17Upgrade go1.17-docUpgrade go1.18-doc | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.16-srcUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.18Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-src | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub