Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade criuUpgrade python3-criuUpgrade delveUpgrade skopeoUpgrade container-selinuxUpgrade podman-pluginsUpgrade critUpgrade crunUpgrade podmanUpgrade podman-catatonitUpgrade podman-testsUpgrade cockpit-podmanUpgrade podman-dockerUpgrade golang-testsUpgrade udicaUpgrade golang-docsUpgrade toolbox-testsUpgrade buildah-testsUpgrade containernetworking-pluginsUpgrade buildahUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade golang-binUpgrade runcUpgrade criu-libsUpgrade aardvark-dnsUpgrade golang-raceUpgrade conmonUpgrade golang-miscUpgrade oci-seccomp-bpf-hookUpgrade python3-podmanUpgrade criu-develUpgrade golang-srcUpgrade golangUpgrade grafana-pcpUpgrade containers-commonUpgrade go-toolsetUpgrade netavarkUpgrade libslirp-develUpgrade slirp4netnsUpgrade git-lfsUpgrade podman-gvproxyUpgrade libslirpUpgrade grafanaUpgrade toolboxUpgrade skopeo-tests | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golist-debuginfoUpgrade golang-raceUpgrade go-rpm-macrosUpgrade golang-github-godbus-dbus-develUpgrade go-filesystemUpgrade golang-srcUpgrade golang-sharedUpgrade golang-github-syndtr-gocapability-develUpgrade golistUpgrade golang-googlecode-net-develUpgrade golang-github-gorilla-mux-develUpgrade runc-debuginfoUpgrade golang-googlecode-sqlite-develUpgrade golang-github-kr-pty-develUpgrade go-rpm-templatesUpgrade golangUpgrade golang-binUpgrade golang-github-gorilla-context-develUpgrade go-srpm-macrosUpgrade golang-testsUpgrade runcUpgrade golang-docs | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-github-cpuguy83-md2man-develUpgrade golang-testsUpgrade golang-srcUpgrade golang-raceUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-miscUpgrade golist-debugsourceUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golangUpgrade golistUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-sharedUpgrade golist-debuginfoUpgrade golang-binUpgrade golang-github-cpuguy83-md2manUpgrade golang-docs | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade podman-gvproxyUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade udicaUpgrade grafana-debuginfoUpgrade cockpit-podmanUpgrade libslirp-debugsourceUpgrade fuse-overlayfsUpgrade toolbox-testsUpgrade skopeo-debugsourceUpgrade grafanaUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade golang-raceUpgrade podman-testsUpgrade podman-dockerUpgrade grafana-pcp-debuginfoUpgrade buildah-testsUpgrade crun-debuginfoUpgrade netavarkUpgrade buildahUpgrade git-lfsUpgrade slirp4netnsUpgrade conmonUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade git-lfs-debugsourceUpgrade toolboxUpgrade skopeo-debuginfoUpgrade container-selinuxUpgrade go-toolsetUpgrade libslirpUpgrade python3-podmanUpgrade fuse-overlayfs-debuginfoUpgrade grafana-pcpUpgrade delveUpgrade skopeo-testsUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade git-lfs-debuginfoUpgrade runc-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-pluginsUpgrade criu-libsUpgrade criu-debugsourceUpgrade golang-srcUpgrade golang-docsUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade delve-debuginfoUpgrade runcUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade podman-debuginfoUpgrade slirp4netns-debugsourceUpgrade skopeoUpgrade podman-remoteUpgrade podman-catatonitUpgrade fuse-overlayfs-debugsourceUpgrade criuUpgrade delve-debugsourceUpgrade golang-testsUpgrade criu-debuginfoUpgrade buildah-debuginfoUpgrade podman-catatonit-debuginfoUpgrade containers-commonUpgrade golang-miscUpgrade aardvark-dnsUpgrade libslirp-develUpgrade slirp4netns-debuginfoUpgrade critUpgrade podman-debugsourceUpgrade golang-binUpgrade toolbox-debugsourceUpgrade golangUpgrade toolbox-debuginfoUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade conmon-debugsourceUpgrade podman | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go117Upgrade go118 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade golang-binUpgrade criuUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade podman-dockerUpgrade golang-docsUpgrade critUpgrade python3-podmanUpgrade buildah-testsUpgrade golang-srcUpgrade podmanUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade podman-testsUpgrade runcUpgrade skopeoUpgrade netavarkUpgrade slirp4netnsUpgrade golangUpgrade libslirpUpgrade udicaUpgrade podman-remoteUpgrade cockpit-podmanUpgrade golang-raceUpgrade buildahUpgrade golang-testsUpgrade fuse-overlayfsUpgrade golang-miscUpgrade go-toolsetUpgrade container-selinuxUpgrade criu-develUpgrade podman-pluginsUpgrade conmonUpgrade libslirp-develUpgrade delveUpgrade oci-seccomp-bpf-hookUpgrade containers-commonUpgrade crunUpgrade python3-criuUpgrade grafanaUpgrade skopeo-testsUpgrade git-lfsUpgrade criu-libsUpgrade grafana-pcp | Aug 4, 2022 | Jul 12, 2022 |
| Redhat Openshift | — | Upgrade cri-toolsUpgrade cri-oUpgrade ignition | Nov 29, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade buildah-debugsourceUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade runc-debuginfoUpgrade container-selinuxUpgrade grafana-pcpUpgrade git-lfs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade containers-commonUpgrade crunUpgrade golang-srcUpgrade podman-remoteUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade grafanaUpgrade skopeo-testsUpgrade delveUpgrade podman-debugsourceUpgrade slirp4netns-debuginfoUpgrade golang-raceUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade libslirp-debugsourceUpgrade podmanUpgrade git-lfsUpgrade criu-develUpgrade containernetworking-pluginsUpgrade python3-podmanUpgrade toolboxUpgrade golang-binUpgrade skopeoUpgrade podman-remote-debuginfoUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade delve-debugsourceUpgrade golang-testsUpgrade slirp4netnsUpgrade git-lfs-debugsourceUpgrade netavarkUpgrade podman-dockerUpgrade go-toolsetUpgrade critUpgrade cockpit-podmanUpgrade criuUpgrade golang-miscUpgrade toolbox-debugsourceUpgrade crun-debuginfoUpgrade podman-catatonitUpgrade skopeo-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade golangUpgrade criu-libs-debuginfoUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade udicaUpgrade aardvark-dnsUpgrade grafana-pcp-debuginfoUpgrade runcUpgrade podman-gvproxyUpgrade podman-testsUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade libslirpUpgrade buildahUpgrade criu-debugsourceNo solution existsUpgrade conmonUpgrade python3-criuUpgrade buildah-tests-debuginfoUpgrade golang-docsUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade skopeo-debuginfoUpgrade conmon-debugsourceUpgrade grafana-debuginfoUpgrade runc-debugsource | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade python3-criuUpgrade fuse-overlayfsUpgrade containers-commonUpgrade criuUpgrade slirp4netns-debugsourceUpgrade grafana-pcpUpgrade libslirp-debuginfoUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podman-remoteUpgrade criu-libs-debuginfoUpgrade golangUpgrade libslirp-develUpgrade runcUpgrade delve-debuginfoUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade skopeoUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade golang-binUpgrade toolbox-debuginfoUpgrade criu-libsUpgrade criu-develUpgrade critUpgrade grafana-debuginfoUpgrade buildah-debugsourceUpgrade toolboxUpgrade containernetworking-pluginsUpgrade criu-debuginfoUpgrade podman-catatonitUpgrade podman-catatonit-debuginfoUpgrade conmon-debugsourceUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debuginfoUpgrade delveUpgrade podmanUpgrade fuse-overlayfs-debugsourceUpgrade git-lfs-debuginfoUpgrade delve-debugsourceUpgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade runc-debuginfoUpgrade slirp4netnsUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade grafana-pcp-debuginfoUpgrade skopeo-debuginfoUpgrade libslirpUpgrade crunUpgrade buildah-debuginfoUpgrade git-lfsUpgrade conmon-debuginfoUpgrade libslirp-debugsourceUpgrade podman-plugins-debuginfoUpgrade conmonUpgrade toolbox-testsUpgrade runc-debugsourceUpgrade crun-debuginfoUpgrade buildah-testsUpgrade golang-raceUpgrade buildahUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade podman-debugsourceUpgrade grafanaUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade go-toolsetUpgrade git-lfs-debugsource | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17-docUpgrade go1.17Upgrade go1.18-docUpgrade go1.17-raceUpgrade go1.18Upgrade go1.18-openssl-raceUpgrade go1.18-openssl-docUpgrade go1.18-opensslUpgrade go1.18-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.16Upgrade golang-1.16 (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.18-srcUpgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.13Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.16-goUpgrade golang-1.18Upgrade golang-1.16-src (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub