vulnerability

Red Hat OpenShift: CVE-2022-32190: golang: net/url: JoinPath does not strip relative path components in all circumstances

Name: Red Hat OpenShift: CVE-2022-32190: golang: net/url: JoinPath does not strip relative path components in all circumstances
Creator: Red Hat
Published: 2022-09-13T00:00:00.000Z
Keywords: CVE, CWE-22, Red Hat OpenShift, 2022, 32190, golang, linuxrpm-upgrade-atomic-openshift-service-idler, linuxrpm-upgrade-buildah, linuxrpm-upgrade-containers-common, linuxrpm-upgrade-kernel, linuxrpm-upgrade-kernel-rt, linuxrpm-upgrade-openshift-clients, linuxrpm-upgrade-openshift-kuryr, linuxrpm-upgrade-ovn22-12, linuxrpm-upgrade-podman, linuxrpm-upgrade-runc, linuxrpm-upgrade-skopeo, Severity 8

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:C/I:N/A:N)

Published

Sep 13, 2022

Added

Jan 26, 2023

Modified

Jun 17, 2026

Description

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

Solutions

linuxrpm-upgrade-atomic-openshift-service-idlerlinuxrpm-upgrade-buildahlinuxrpm-upgrade-containers-commonlinuxrpm-upgrade-kernellinuxrpm-upgrade-kernel-rtlinuxrpm-upgrade-openshift-clientslinuxrpm-upgrade-openshift-kuryrlinuxrpm-upgrade-ovn22-12linuxrpm-upgrade-podmanlinuxrpm-upgrade-runclinuxrpm-upgrade-skopeo

References

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report