CVE-2022-32148: Exposure of client IP addresses in net/http
A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set the client IP incorrectly. This issue may affect confidentiality.
Other sources
Exposure of client IP addresses in net/http
— Microsoft
When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more usual case where a Director function set the X-Forwarded-For header value to nil, ReverseProxy would leave the header unmodified as expected.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2022:6113
- RHSA-2022:6183
- RHSA-2022:6345
- RHSA-2022:6188
- RHSA-2022:6430
- RHSA-2023:1042
- RHSA-2023:3664
- RHSA-2022:6040
- RHSA-2022:6042
- RHSA-2022:6152
- RHSA-2022:6348
- RHSA-2022:6346
- RHSA-2022:6347
- RHSA-2022:6370
- RHSA-2023:3642
- RHSA-2022:5866
- RHSA-2022:5775
- RHSA-2022:7129
- RHSA-2022:7519
- RHSA-2022:7529
- RHSA-2022:7648
- RHSA-2023:2758
- RHSA-2023:2802
- RHSA-2022:5799
- RHSA-2022:8057
- RHSA-2022:8250
- RHSA-2023:2357
- RHSA-2022:9047
- RHSA-2022:8626
- RHSA-2022:7398
- RHSA-2022:7399
- RHSA-2022:6283
- RHSA-2023:1275
- RHSA-2023:0407
- RHSA-2023:0408
- RHSA-2022:6344
- IBM-7173596
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-32148.
What is the severity of CVE-2022-32148?
The severity of CVE-2022-32148 is medium (6.5).
What software versions are affected by CVE-2022-32148?
CVE-2022-32148 affects versions before Go 1.17.12 and Go 1.18.4.
How can the vulnerability be exploited?
The vulnerability can be exploited by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header.
Is there a fix available for CVE-2022-32148?
Yes, the fix for CVE-2022-32148 is available in Go 1.17.12 and Go 1.18.4.