Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade runcUpgrade python3-criuUpgrade udicaUpgrade podman-pluginsUpgrade golang-testsUpgrade toolbox-testsUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade golang-binUpgrade delveUpgrade crunUpgrade podman-catatonitUpgrade skopeoUpgrade critUpgrade golang-docsUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade buildahUpgrade buildah-testsUpgrade podman-testsUpgrade criuUpgrade podmanUpgrade podman-dockerUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade go-toolsetUpgrade grafanaUpgrade netavarkUpgrade golangUpgrade skopeo-testsUpgrade libslirpUpgrade grafana-pcpUpgrade criu-libsUpgrade golang-srcUpgrade git-lfsUpgrade containers-commonUpgrade golang-miscUpgrade criu-develUpgrade libslirp-develUpgrade podman-gvproxyUpgrade oci-seccomp-bpf-hookUpgrade toolboxUpgrade python3-podmanUpgrade golang-raceUpgrade aardvark-dnsUpgrade conmon | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade go-rpm-templatesUpgrade golangUpgrade go-srpm-macrosUpgrade golang-testsUpgrade golang-binUpgrade runcUpgrade golang-github-kr-pty-develUpgrade golang-github-gorilla-context-develUpgrade golang-docsUpgrade golang-srcUpgrade golistUpgrade go-filesystemUpgrade golang-github-gorilla-mux-develUpgrade golang-googlecode-net-develUpgrade golang-miscUpgrade golang-googlecode-sqlite-develUpgrade golang-github-syndtr-gocapability-develUpgrade runc-debuginfoUpgrade golist-debuginfoUpgrade golang-raceUpgrade go-rpm-macrosUpgrade golang-github-godbus-dbus-develUpgrade golang-shared | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golang-raceUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-miscUpgrade golistUpgrade golang-github-cpuguy83-md2man-debuginfoUpgrade golang-binUpgrade golist-debuginfoUpgrade golang-sharedUpgrade golist-debugsourceUpgrade golang-docsUpgrade golang-github-cpuguy83-md2manUpgrade golang-srcUpgrade golang-testsUpgrade golangUpgrade golang-github-cpuguy83-md2man-devel | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade libslirp-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade criu-develUpgrade crun-debugsourceUpgrade delve-debuginfoUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libs-debuginfoUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade runc-debugsourceUpgrade criu-libsUpgrade runc-debuginfoUpgrade golang-docsUpgrade delve-debugsourceUpgrade containernetworking-pluginsUpgrade podmanUpgrade podman-debugsourceUpgrade golang-srcUpgrade podman-pluginsUpgrade podman-remote-debuginfoUpgrade podman-catatonit-debuginfoUpgrade buildah-debuginfoUpgrade golang-testsUpgrade fuse-overlayfs-debugsourceUpgrade golangUpgrade criu-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeoUpgrade criu-debuginfoUpgrade podman-remoteUpgrade golang-binUpgrade libslirp-develUpgrade delveUpgrade golang-miscUpgrade criuUpgrade podman-catatonitUpgrade toolbox-debugsourceUpgrade toolbox-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade git-lfs-debuginfoUpgrade containers-commonUpgrade aardvark-dnsUpgrade grafana-pcpUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade runcUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade netavarkUpgrade libslirp-debugsourceUpgrade buildahUpgrade slirp4netnsUpgrade podman-testsUpgrade podman-dockerUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade grafanaUpgrade golang-raceUpgrade fuse-overlayfsUpgrade libslirpUpgrade skopeo-debuginfoUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade conmon-debuginfoUpgrade podman-gvproxyUpgrade crun-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade udicaUpgrade toolbox-testsUpgrade cockpit-podmanUpgrade python3-podmanUpgrade go-toolsetUpgrade container-selinuxUpgrade toolboxUpgrade grafana-pcp-debuginfoUpgrade grafana-debuginfoUpgrade git-lfsUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade git-lfs-debugsource | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go118Upgrade go117 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade cockpit-podmanUpgrade podman-catatonitUpgrade golang-testsUpgrade critUpgrade podman-testsUpgrade podmanUpgrade skopeoUpgrade golang-docsUpgrade golang-srcUpgrade podman-gvproxyUpgrade python3-podmanUpgrade buildah-testsUpgrade buildahUpgrade runcUpgrade golang-raceUpgrade netavarkUpgrade podman-remoteUpgrade golangUpgrade podman-dockerUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade golang-miscUpgrade containernetworking-pluginsUpgrade libslirpUpgrade udicaUpgrade criuUpgrade golang-binUpgrade slirp4netnsUpgrade delveUpgrade go-toolsetUpgrade criu-libsUpgrade conmonUpgrade git-lfsUpgrade criu-develUpgrade libslirp-develUpgrade grafana-pcpUpgrade crunUpgrade python3-criuUpgrade grafanaUpgrade skopeo-testsUpgrade containers-commonUpgrade podman-pluginsUpgrade container-selinuxUpgrade oci-seccomp-bpf-hook | Aug 4, 2022 | Jul 12, 2022 |
| Redhat Openshift | — | Upgrade cri-oUpgrade ignitionUpgrade cri-tools | Nov 29, 2022 | Jul 12, 2022 |
| Redhat_linux | — | Upgrade python3-criuUpgrade conmonUpgrade buildahUpgrade podman-gvproxyNo solution existsUpgrade podman-testsUpgrade toolbox-testsUpgrade fuse-overlayfsUpgrade critUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade podman-catatonitUpgrade go-toolsetUpgrade golang-docsUpgrade libslirpUpgrade conmon-debugsourceUpgrade grafana-debuginfoUpgrade conmon-debuginfoUpgrade criuUpgrade netavarkUpgrade buildah-tests-debuginfoUpgrade criu-libs-debuginfoUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade runcUpgrade skopeo-debuginfoUpgrade cockpit-podmanUpgrade golang-miscUpgrade grafana-pcp-debuginfoUpgrade udicaUpgrade toolbox-debugsourceUpgrade podman-dockerUpgrade git-lfs-debugsourceUpgrade runc-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade buildah-testsUpgrade golangUpgrade criu-debugsourceUpgrade criu-libsUpgrade git-lfs-debuginfoUpgrade delveUpgrade containers-commonUpgrade golang-binUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-debuginfoUpgrade skopeoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade podman-remoteUpgrade golang-testsUpgrade buildah-debugsourceUpgrade grafana-pcpUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade delve-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade crun-debugsourceUpgrade container-selinuxUpgrade python3-podmanUpgrade fuse-overlayfs-debuginfoUpgrade golang-srcUpgrade criu-develUpgrade podman-debugsourceUpgrade crunUpgrade git-lfsUpgrade toolboxUpgrade delve-debuginfoUpgrade libslirp-develUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade golang-raceUpgrade containernetworking-plugins-debuginfoUpgrade podman-pluginsUpgrade skopeo-testsUpgrade libslirp-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-debugsourceUpgrade podman-remote-debuginfoUpgrade podmanUpgrade grafana | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade conmon-debugsourceUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade critUpgrade buildah-tests-debuginfoUpgrade criuUpgrade delveUpgrade runc-debuginfoUpgrade toolbox-debugsourceUpgrade buildah-debugsourceUpgrade criu-debugsourceUpgrade podmanUpgrade delve-debugsourceUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade fuse-overlayfs-debugsourceUpgrade podman-pluginsUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade grafana-debuginfoUpgrade podman-catatonitUpgrade criu-libsUpgrade golang-binUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade criu-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade toolboxUpgrade git-lfs-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-debuginfoUpgrade libslirp-develUpgrade libslirp-debuginfoUpgrade runcUpgrade containers-commonUpgrade criu-libs-debuginfoUpgrade skopeoUpgrade grafana-pcpUpgrade golangUpgrade crun-debuginfoUpgrade libslirpUpgrade crunUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade grafana-pcp-debuginfoUpgrade libslirp-debugsourceUpgrade go-toolsetUpgrade git-lfsUpgrade conmon-debuginfoUpgrade conmonUpgrade git-lfs-debugsourceUpgrade runc-debugsourceUpgrade buildah-testsUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade podman-testsUpgrade podman-debugsourceUpgrade grafanaUpgrade buildahUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-plugins-debuginfoUpgrade golang-raceUpgrade toolbox-testsUpgrade slirp4netns-debuginfo | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 8.2.11 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17-raceUpgrade go1.18-docUpgrade go1.17Upgrade go1.17-docUpgrade go1.18-raceUpgrade go1.18-openssl-docUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.18-openssl-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.16-goUpgrade golang-1.18Upgrade golang-1.13Upgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.16-srcUpgrade golang-1.18-srcUpgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.13-srcUpgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13-goUpgrade golang-1.16 (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub