Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libslirpUpgrade grafana-pcpUpgrade skopeo-testsUpgrade golang-miscUpgrade grafanaUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade containers-commonUpgrade golang-raceUpgrade golang-srcUpgrade podman-gvproxyUpgrade toolboxUpgrade python3-podmanUpgrade libslirp-develUpgrade git-lfsUpgrade criu-develUpgrade netavarkUpgrade golangUpgrade go-toolsetUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade delveUpgrade criuUpgrade podman-pluginsUpgrade podman-dockerUpgrade podman-testsUpgrade toolbox-testsUpgrade golang-testsUpgrade python3-criuUpgrade podmanUpgrade podman-catatonitUpgrade buildah-testsUpgrade golang-docsUpgrade containernetworking-pluginsUpgrade skopeoUpgrade golang-binUpgrade podman-remoteUpgrade runcUpgrade critUpgrade container-selinuxUpgrade udicaUpgrade crunUpgrade buildah | Aug 8, 2022 | Aug 1, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Aug 9, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-raceUpgrade golang-googlecode-net-develUpgrade golang-github-gorilla-mux-develUpgrade golang-sharedUpgrade golistUpgrade runc-debuginfoUpgrade golang-miscUpgrade golang-googlecode-sqlite-develUpgrade golang-github-syndtr-gocapability-develUpgrade golang-srcUpgrade go-rpm-macrosUpgrade golang-github-godbus-dbus-develUpgrade golist-debuginfoUpgrade go-filesystemUpgrade golang-binUpgrade go-srpm-macrosUpgrade golangUpgrade golang-docsUpgrade runcUpgrade golang-github-gorilla-context-develUpgrade golang-github-kr-pty-develUpgrade golang-testsUpgrade go-rpm-templates | Oct 11, 2022 | Aug 10, 2022 |
| Amazon_linux | — | Upgrade golang | Sep 30, 2022 | Aug 3, 2022 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golang-github-cpuguy83-md2manUpgrade golang-sharedUpgrade golist-debuginfoUpgrade golang-binUpgrade golangUpgrade compat-golang-github-cpuguy83-md2man-2-develUpgrade golang-testsUpgrade golang-srcUpgrade golang-github-cpuguy83-md2man-develUpgrade golang-miscUpgrade golang-github-cpuguy83-md2man-debugsourceUpgrade golistUpgrade golist-debugsourceUpgrade golang-raceUpgrade golang-github-cpuguy83-md2man-debuginfo | Feb 17, 2025 | Jul 12, 2022 |
| Centos_linux | — | Upgrade criu-develUpgrade podman-debuginfoUpgrade podman-remoteUpgrade toolbox-debuginfoUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade delveUpgrade toolbox-debugsourceUpgrade python3-criuUpgrade runc-debuginfoUpgrade golang-docsUpgrade libslirp-develUpgrade skopeo-testsUpgrade delve-debuginfoUpgrade podmanUpgrade golang-srcUpgrade containernetworking-pluginsUpgrade critUpgrade golang-miscUpgrade podman-gvproxy-debuginfoUpgrade golang-binUpgrade delve-debugsourceUpgrade libslirp-debuginfoUpgrade criu-debuginfoUpgrade golang-testsUpgrade aardvark-dnsUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade conmon-debugsourceUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade slirp4netns-debuginfoUpgrade runcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade golangUpgrade skopeoUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade criu-libsUpgrade git-lfs-debuginfoUpgrade podman-catatonitUpgrade podman-debugsourceUpgrade slirp4netns-debugsourceUpgrade grafana-pcpUpgrade criu-libs-debuginfoUpgrade podman-pluginsUpgrade criuUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade grafanaUpgrade libslirp-debugsourceUpgrade buildah-testsUpgrade golang-raceUpgrade podman-gvproxyUpgrade crunUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade udicaUpgrade crun-debuginfoUpgrade skopeo-debugsourceUpgrade buildahUpgrade netavarkUpgrade slirp4netnsUpgrade podman-testsUpgrade podman-dockerUpgrade grafana-pcp-debuginfoUpgrade grafana-debuginfoUpgrade git-lfsUpgrade skopeo-debuginfoUpgrade python3-podmanUpgrade libslirpUpgrade go-toolsetUpgrade container-selinuxUpgrade toolboxUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade git-lfs-debugsourceUpgrade fuse-overlayfsUpgrade conmon-debuginfoUpgrade toolbox-testsUpgrade cockpit-podman | Aug 2, 2022 | Aug 1, 2022 |
| Debian | — | Upgrade golang-1.19 | Jul 30, 2024 | Aug 10, 2022 |
| Freebsd | — | Upgrade go117Upgrade go118 | Nov 4, 2022 | Jul 13, 2022 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Aug 5, 2022 | Aug 4, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Nov 3, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-binUpgrade golang-srcUpgrade golang | Nov 4, 2022 | Aug 10, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Sep 14, 2022 | Aug 10, 2022 |
| Oracle_linux | — | Upgrade containernetworking-pluginsUpgrade golang-docsUpgrade skopeoUpgrade udicaUpgrade podman-dockerUpgrade golang-srcUpgrade podmanUpgrade fuse-overlayfsUpgrade critUpgrade podman-gvproxyUpgrade python3-podmanUpgrade aardvark-dnsUpgrade libslirpUpgrade golang-miscUpgrade golangUpgrade netavarkUpgrade runcUpgrade golang-raceUpgrade podman-remoteUpgrade buildahUpgrade golang-testsUpgrade podman-testsUpgrade buildah-testsUpgrade podman-catatonitUpgrade golang-binUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade criuUpgrade podman-pluginsUpgrade conmonUpgrade grafanaUpgrade go-toolsetUpgrade libslirp-develUpgrade grafana-pcpUpgrade delveUpgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade git-lfsUpgrade crunUpgrade criu-develUpgrade skopeo-testsUpgrade python3-criuUpgrade containers-commonUpgrade criu-libs | Aug 4, 2022 | Jul 12, 2022 |
| Redhat Openshift | — | Upgrade ignitionUpgrade cri-toolsUpgrade cri-o | Nov 29, 2022 | Aug 10, 2022 |
| Redhat_linux | — | Upgrade toolbox-testsUpgrade podman-gvproxyUpgrade criuUpgrade crun-debuginfoUpgrade buildah-testsUpgrade skopeo-debugsourceUpgrade netavarkUpgrade golang-docsUpgrade slirp4netnsUpgrade buildahUpgrade podman-dockerUpgrade toolbox-debugsourceUpgrade go-toolsetNo solution existsUpgrade podman-gvproxy-debuginfoUpgrade critUpgrade podman-catatonitUpgrade git-lfs-debugsourceUpgrade grafana-debuginfoUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade libslirpUpgrade aardvark-dnsUpgrade python3-criuUpgrade criu-libs-debuginfoUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade conmon-debugsourceUpgrade fuse-overlayfsUpgrade criu-debugsourceUpgrade golangUpgrade skopeo-debuginfoUpgrade podman-testsUpgrade grafana-pcp-debuginfoUpgrade runcUpgrade cockpit-podmanUpgrade buildah-tests-debuginfoUpgrade golang-miscUpgrade udicaUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade git-lfsUpgrade criu-develUpgrade fuse-overlayfs-debuginfoUpgrade golang-testsUpgrade skopeo-testsUpgrade criu-libsUpgrade containernetworking-plugins-debuginfoUpgrade podman-debuginfoUpgrade git-lfs-debuginfoUpgrade golang-raceUpgrade grafanaUpgrade containers-commonUpgrade grafana-pcpUpgrade container-selinuxUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade delve-debuginfoUpgrade delve-debugsourceUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirp-debuginfoUpgrade podmanUpgrade podman-remoteUpgrade python3-podmanUpgrade golang-binUpgrade delveUpgrade podman-debugsourceUpgrade crunUpgrade libslirp-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade podman-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade libslirp-develUpgrade runc-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade golang-srcUpgrade skopeoUpgrade slirp4netns-debuginfo | Aug 3, 2022 | Aug 1, 2022 |
| Rocky_linux | — | Upgrade podman-remote-debuginfoUpgrade toolbox-debugsourceUpgrade conmon-debugsourceUpgrade runc-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade buildah-debugsourceUpgrade podmanUpgrade delve-debugsourceUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-debuginfoUpgrade criu-libsUpgrade containers-commonUpgrade golang-binUpgrade toolboxUpgrade grafana-pcpUpgrade libslirp-debuginfoUpgrade delveUpgrade grafana-debuginfoUpgrade podman-catatonitUpgrade podman-pluginsUpgrade critUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debuginfoUpgrade delve-debuginfoUpgrade podman-remoteUpgrade podman-debuginfoUpgrade git-lfs-debuginfoUpgrade buildah-tests-debuginfoUpgrade python3-criuUpgrade containernetworking-plugins-debuginfoUpgrade containernetworking-pluginsUpgrade criu-debuginfoUpgrade skopeoUpgrade podman-catatonit-debuginfoUpgrade skopeo-testsUpgrade libslirp-develUpgrade criu-libs-debuginfoUpgrade runcUpgrade golangUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade runc-debugsourceUpgrade crun-debuginfoUpgrade go-toolsetUpgrade slirp4netnsUpgrade buildah-testsUpgrade golang-raceUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildahUpgrade podman-debugsourceUpgrade grafanaUpgrade skopeo-debugsourceUpgrade buildah-debuginfoUpgrade skopeo-debuginfoUpgrade libslirpUpgrade crunUpgrade conmonUpgrade podman-plugins-debuginfoUpgrade git-lfs-debugsourceUpgrade git-lfsUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolbox-testsUpgrade grafana-pcp-debuginfoUpgrade containernetworking-plugins-debugsource | Mar 12, 2024 | Aug 10, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5 | Sep 30, 2025 | Aug 9, 2022 |
| Suse | — | Upgrade go1.17-raceUpgrade go1.17-docUpgrade go1.17Upgrade go1.18-docUpgrade go1.18Upgrade go1.18-opensslUpgrade go1.18-openssl-docUpgrade go1.18-openssl-raceUpgrade go1.18-race | Oct 26, 2022 | Aug 10, 2022 |
| Ubuntu | — | Upgrade golang-1.16-goUpgrade golang-1.13Upgrade golang-1.16-go (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.16-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.16-srcUpgrade golang-1.18-goUpgrade golang-1.13-go (Ubuntu Pro)Upgrade golang-1.13-src (Ubuntu Pro)Upgrade golang-1.16Upgrade golang-1.13 (Ubuntu Pro)Upgrade golang-1.13-goUpgrade golang-1.13-srcUpgrade golang-1.16 (Ubuntu Pro) | May 1, 2023 | Aug 10, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 9, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub