Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade delveUpgrade crunUpgrade runcUpgrade podman-testsUpgrade toolbox-testsUpgrade buildah-testsUpgrade podmanUpgrade udicaUpgrade golang-testsUpgrade python3-criuUpgrade podman-pluginsUpgrade critUpgrade skopeoUpgrade golang-docsUpgrade podman-dockerUpgrade podman-catatonitUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade golang-binUpgrade buildahUpgrade cockpit-podmanUpgrade criuUpgrade libslirpUpgrade containers-commonUpgrade golang-raceUpgrade criu-libsUpgrade grafana-pcpUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade git-lfsUpgrade conmonUpgrade netavarkUpgrade criu-develUpgrade golangUpgrade oci-seccomp-bpf-hookUpgrade golang-miscUpgrade grafanaUpgrade golang-srcUpgrade podman-gvproxyUpgrade go-toolsetUpgrade toolboxUpgrade slirp4netnsUpgrade python3-podmanUpgrade libslirp-devel | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-binUpgrade runcUpgrade golang-testsUpgrade golangUpgrade go-srpm-macrosUpgrade golang-github-gorilla-context-develUpgrade go-rpm-templatesUpgrade golang-docsUpgrade golang-github-kr-pty-develUpgrade golang-sharedUpgrade go-filesystemUpgrade golang-raceUpgrade golang-github-godbus-dbus-develUpgrade go-rpm-macrosUpgrade golistUpgrade golang-googlecode-sqlite-develUpgrade golang-googlecode-net-develUpgrade golang-miscUpgrade runc-debuginfoUpgrade golang-github-syndtr-gocapability-develUpgrade golang-github-gorilla-mux-develUpgrade golist-debuginfoUpgrade golang-src | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-sharedUpgrade golang-binUpgrade golang-docsUpgrade golist-debuginfoUpgrade golang-github-cpuguy83-md2manUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golist-debugsourceUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golangUpgrade golang-testsUpgrade golang-srcUpgrade golang-github-cpuguy83-md2man-develUpgrade golistUpgrade golang-miscUpgrade golang-race | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade skopeo-testsUpgrade containernetworking-pluginsUpgrade podmanUpgrade criu-libsUpgrade criu-debugsourceUpgrade podman-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade podman-plugins-debuginfoUpgrade grafana-pcpUpgrade oci-seccomp-bpf-hookUpgrade podman-debuginfoUpgrade slirp4netns-debugsourceUpgrade runc-debugsourceUpgrade git-lfs-debuginfoUpgrade criuUpgrade aardvark-dnsUpgrade golang-binUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade runc-debuginfoUpgrade golang-docsUpgrade golang-srcUpgrade critUpgrade delveUpgrade containers-commonUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade golang-miscUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade libslirp-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-catatonitUpgrade buildah-tests-debuginfoUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade golang-testsUpgrade delve-debugsourceUpgrade criu-develUpgrade crun-debugsourceUpgrade buildah-debuginfoUpgrade golangUpgrade delve-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade podman-catatonit-debuginfoUpgrade slirp4netnsUpgrade containernetworking-plugins-debuginfoUpgrade libslirpUpgrade buildahUpgrade netavarkUpgrade crun-debuginfoUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade cockpit-podmanUpgrade buildah-testsUpgrade podman-gvproxyUpgrade udicaUpgrade conmon-debuginfoUpgrade toolboxUpgrade python3-podmanUpgrade go-toolsetUpgrade container-selinuxUpgrade skopeo-debuginfoUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade grafana-pcp-debuginfoUpgrade grafana-debuginfoUpgrade git-lfsUpgrade crunUpgrade libslirp-debugsourceUpgrade toolbox-testsUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade grafanaUpgrade golang-race | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go117Upgrade go118 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade criu-develUpgrade conmonUpgrade delveUpgrade criu-libsUpgrade go-toolsetUpgrade grafana-pcpUpgrade libslirp-develUpgrade python3-criuUpgrade git-lfsUpgrade crunUpgrade skopeo-testsUpgrade grafanaUpgrade podman-pluginsUpgrade container-selinuxUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade libslirpUpgrade golang-miscUpgrade udicaUpgrade podmanUpgrade skopeoUpgrade criuUpgrade netavarkUpgrade runcUpgrade slirp4netnsUpgrade golang-binUpgrade golangUpgrade podman-remoteUpgrade python3-podmanUpgrade podman-gvproxyUpgrade critUpgrade golang-docsUpgrade podman-dockerUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade golang-testsUpgrade golang-raceUpgrade cockpit-podmanUpgrade buildahUpgrade podman-testsUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade buildah-testsUpgrade golang-src | Aug 4, 2022 | Jul 12, 2022 |
| Redhat Openshift | — | Upgrade cri-toolsUpgrade ignitionUpgrade cri-o | Nov 29, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade toolbox-debuginfoUpgrade grafana-pcpUpgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade delve-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade container-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade toolboxUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade git-lfsUpgrade criu-libsUpgrade grafanaUpgrade golang-testsUpgrade podmanUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade golang-binUpgrade podman-remoteUpgrade golang-srcUpgrade podman-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeoUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade git-lfs-debuginfoUpgrade delve-debuginfoUpgrade libslirp-debugsourceUpgrade podman-remote-debuginfoUpgrade python3-podmanUpgrade criu-develUpgrade delveUpgrade podman-debugsourceUpgrade crunUpgrade golang-raceUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debuginfoUpgrade libslirp-develUpgrade containernetworking-plugins-debuginfoUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade libslirp-debuginfoUpgrade golangUpgrade critUpgrade conmon-debugsourceUpgrade netavarkNo solution existsUpgrade criu-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade criu-libs-debuginfoUpgrade conmon-debuginfoUpgrade skopeo-debugsourceUpgrade slirp4netnsUpgrade buildah-tests-debuginfoUpgrade toolbox-testsUpgrade criuUpgrade podman-testsUpgrade buildahUpgrade libslirpUpgrade criu-debugsourceUpgrade python3-criuUpgrade conmonUpgrade buildah-debuginfoUpgrade grafana-debuginfoUpgrade podman-catatonitUpgrade runc-debugsourceUpgrade toolbox-debugsourceUpgrade go-toolsetUpgrade podman-dockerUpgrade crun-debuginfoUpgrade grafana-pcp-debuginfoUpgrade golang-miscUpgrade runcUpgrade skopeo-debuginfoUpgrade buildah-testsUpgrade udicaUpgrade golang-docsUpgrade git-lfs-debugsourceUpgrade aardvark-dns | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade criu-develUpgrade delve-debugsourceUpgrade podman-pluginsUpgrade runc-debuginfoUpgrade toolboxUpgrade libslirp-develUpgrade runcUpgrade buildah-debugsourceUpgrade skopeoUpgrade golangUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade git-lfs-debuginfoUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade slirp4netns-debugsourceUpgrade toolbox-debugsourceUpgrade podman-remoteUpgrade libslirp-debuginfoUpgrade podman-remote-debuginfoUpgrade grafana-pcpUpgrade toolbox-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade criuUpgrade buildah-tests-debuginfoUpgrade delve-debuginfoUpgrade fuse-overlayfsUpgrade python3-criuUpgrade criu-debugsourceUpgrade containers-commonUpgrade critUpgrade skopeo-testsUpgrade podman-catatonitUpgrade crun-debugsourceUpgrade delveUpgrade golang-binUpgrade grafana-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade git-lfs-debugsourceUpgrade conmon-debuginfoUpgrade libslirpUpgrade go-toolsetUpgrade libslirp-debugsourceUpgrade conmonUpgrade buildah-testsUpgrade slirp4netnsUpgrade runc-debugsourceUpgrade crun-debuginfoUpgrade podman-debugsourceUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildahUpgrade skopeo-debugsourceUpgrade grafanaUpgrade skopeo-debuginfoUpgrade podman-plugins-debuginfoUpgrade golang-raceUpgrade git-lfsUpgrade grafana-pcp-debuginfo | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.1.14 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17Upgrade go1.17-docUpgrade go1.18-docUpgrade go1.17-raceUpgrade go1.18-openssl-docUpgrade go1.18-openssl-raceUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.18-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.13Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.18-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.18Upgrade golang-1.16-srcUpgrade golang-1.13-srcUpgrade golang-1.16Upgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13 (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub