CVE-2022-2880: Incorrect sanitization of forwarded query parameters in net/http/httputil
A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query parameters in the forwarded query when the outbound request's form field is set after the reverse proxy. The director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the original query parameters unchanged.
Other sources
Golang Go could allow a remote attacker to conduct query parameter smuggling, caused by the inclusion of unparseable parameters rejected by net/http in requests forwarded by ReverseProxy. An attacker could exploit this vulnerability to conduct query parameter smuggling.
— IBM
Incorrect sanitization of forwarded query parameters in net/http/httputil
— Microsoft
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Requests forwarded by ReverseProxy included the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value.
ReverseProxy will now sanitize the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy.Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Ref: https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2023:1174
- RHSA-2023:1042
- RHSA-2023:3664
- RHSA-2023:0708
- RHSA-2023:0584
- RHSA-2023:0631
- RHSA-2023:3642
- RHSA-2023:0445
- RHSA-2023:0446
- RHSA-2023:2780
- RHSA-2023:2784
- RHSA-2023:2866
- RHSA-2023:0328
- RHSA-2023:2167
- RHSA-2023:2204
- RHSA-2023:2357
- RHSA-2023:0693
- RHSA-2022:8535
- RHSA-2022:7398
- RHSA-2022:7399
- RHSA-2023:0727
- RHSA-2023:3613
- RHSA-2023:0542
- RHSA-2023:1275
- RHSA-2023:3205
- RHSA-2023:3742
- RHSA-2022:8781
- RHSA-2023:0264
- RHSA-2023:0709
- RHSA-2023:4003
- IBM-7183851
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-2880.
What is the severity of CVE-2022-2880?
The severity of CVE-2022-2880 is high with a CVSS score of 7.5.
Which software packages are affected by CVE-2022-2880?
The affected software packages include go, openshift-serverless-clients, go-toolset, osbuild-composer, weldr-client, grafana, git-lfs, golang, ignition, openshift-clients, buildah, conmon, podman, skopeo, etcd, and skupper-cli.
What is the remediation for CVE-2022-2880?
The remediation for CVE-2022-2880 is to upgrade to version 1.19.2 of the go package.
Where can I find more information about CVE-2022-2880?
More information about CVE-2022-2880 can be found in the following references: [Link 1](https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2132876), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2132877).