{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-1996", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "assignerShortName": "@huntrdev", "dateUpdated": "2024-08-03T00:24:43.677Z", "dateReserved": "2022-06-06T00:00:00", "datePublished": "2022-06-06T00:00:00"}, "containers": {"cna": {"title": "Authorization Bypass Through User-Controlled Key in emicklei/go-restful", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntrdev", "dateUpdated": "2023-02-23T00:00:00"}, "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0."}], "affected": [{"vendor": "emicklei", "product": "emicklei/go-restful", "versions": [{"version": "unspecified", "lessThan": "v3.8.0", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1"}, {"url": "https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10"}, {"name": "FEDORA-2022-185697ef56", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/"}, {"name": "FEDORA-2022-589a0ad690", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/"}, {"name": "FEDORA-2022-fae3ecee19", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"}, {"name": "FEDORA-2022-ba365d3703", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"}, {"name": "FEDORA-2022-30c5ed5625", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"}, {"url": "https://security.netapp.com/advisory/ntap-20220923-0005/"}, {"name": "FEDORA-2023-6550d9323b", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/"}, {"name": "FEDORA-2023-4e2068ba5d", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/"}, {"name": "FEDORA-2023-c9b2182a4e", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639"}]}], "source": {"advisory": "be837427-415c-4d8c-808b-62ce20aa84f1", "discovery": "EXTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:43.677Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1", "tags": ["x_transferred"]}, {"url": "https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10", "tags": ["x_transferred"]}, {"name": "FEDORA-2022-185697ef56", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/"}, {"name": "FEDORA-2022-589a0ad690", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/"}, {"name": "FEDORA-2022-fae3ecee19", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"}, {"name": "FEDORA-2022-ba365d3703", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"}, {"name": "FEDORA-2022-30c5ed5625", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"}, {"url": "https://security.netapp.com/advisory/ntap-20220923-0005/", "tags": ["x_transferred"]}, {"name": "FEDORA-2023-6550d9323b", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/"}, {"name": "FEDORA-2023-4e2068ba5d", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/"}, {"name": "FEDORA-2023-c9b2182a4e", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:go-restful_project:go-restful:*:*:*:*:*:*:*:*", "matchCriteriaId": "23CD29C7-E4EC-47EF-8D44-4976CC43789C", "versionEndExcluding": "2.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:go-restful_project:go-restful:*:*:*:*:*:*:*:*", "matchCriteriaId": "9244D03B-7D8E-4215-9BBC-0E78B70C4EEC", "versionEndExcluding": "3.8.0", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0."}, {"lang": "es", "value": "Una Omisi\u00f3n de la Autorizaci\u00f3n Mediante una Clave Controlada por el Usuario en el repositorio GitHub emicklei/go-restful versiones anteriores a v3.8.0"}], "id": "CVE-2022-1996", "lastModified": "2023-11-07T03:42:22.873", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-08T13:15:07.987", "references": [{"source": "security@huntr.dev", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/"}, {"source": "security@huntr.dev", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"}, {"source": "security@huntr.dev", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20220923-0005/"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@huntr.dev", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2023:0814", "cpe": "cpe:/a:redhat:cryostat:2::el8", "package": "cryostat-tech-preview/cryostat-grafana-dashboard-rhel8:2.2.0-14", "product_name": "Cryostat 2 on RHEL 8", "release_date": "2023-02-20T00:00:00Z"}, {"advisory": "RHSA-2023:0814", "cpe": "cpe:/a:redhat:cryostat:2::el8", "package": "cryostat-tech-preview/cryostat-operator-bundle:2.2.1-8", "product_name": "Cryostat 2 on RHEL 8", "release_date": "2023-02-20T00:00:00Z"}, {"advisory": "RHSA-2023:0814", "cpe": "cpe:/a:redhat:cryostat:2::el8", "package": "cryostat-tech-preview/cryostat-reports-rhel8:1.1.1-9", "product_name": "Cryostat 2 on RHEL 8", "release_date": "2023-02-20T00:00:00Z"}, {"advisory": "RHSA-2023:0814", "cpe": "cpe:/a:redhat:cryostat:2::el8", "package": "cryostat-tech-preview/cryostat-rhel8:2.2.1-8", "product_name": "Cryostat 2 on RHEL 8", "release_date": "2023-02-20T00:00:00Z"}, {"advisory": "RHSA-2023:0814", "cpe": "cpe:/a:redhat:cryostat:2::el8", "package": "cryostat-tech-preview/cryostat-rhel8-operator:2.2.1-11", "product_name": "Cryostat 2 on RHEL 8", "release_date": "2023-02-20T00:00:00Z"}, {"advisory": "RHSA-2023:0814", "cpe": "cpe:/a:redhat:cryostat:2::el8", "package": "cryostat-tech-preview/jfr-datasource-rhel8:2.2.0-14", "product_name": "Cryostat 2 on RHEL 8", "release_date": "2023-02-20T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/client-kn-rhel8:1.3.1-4", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-controller-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-mtping-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-storage-version-migration-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-sugar-controller-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/eventing-webhook-rhel8:1.3.2-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/ingress-rhel8-operator:1.24.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/knative-rhel8-operator:1.24.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/kn-cli-artifacts-rhel8:1.3.1-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/kourier-control-rhel8:1.3.0-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/net-istio-controller-rhel8:1.3.0-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/net-istio-webhook-rhel8:1.3.0-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serverless-operator-bundle:1.24.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serverless-rhel8-operator:1.24.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-activator-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-autoscaler-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-controller-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-domain-mapping-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-queue-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-storage-version-migration-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/serving-webhook-rhel8:1.3.0-3", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1/svls-must-gather-rhel8:1.24.0-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6040", "cpe": "cpe:/a:redhat:serverless:1.24::el8", "package": "openshift-serverless-1-tech-preview/eventing-kafka-broker-webhook-rhel8:1.3.2-2", "product_name": "Openshift Serveless 1.24", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2022:6042", "cpe": "cpe:/a:redhat:serverless:1.0::el8", "package": "openshift-serverless-clients-0:1.3.1-4.el8", "product_name": "Openshift Serverless 1 on RHEL 8", "release_date": "2022-08-10T00:00:00Z"}, {"advisory": "RHSA-2023:3229", "cpe": "cpe:/a:redhat:openshift_gitops:1.8::el8", "package": "openshift-gitops-kam-0:1.8.3-6.el8", "product_name": "Red Hat OpenShift GitOps 1.8", "release_date": "2023-05-18T00:00:00Z"}, {"advisory": "RHSA-2023:3557", "cpe": "cpe:/a:redhat:openshift_gitops:1.9::el9", "package": "openshift-gitops-kam-0:1.9.0-102.el8", "product_name": "Red Hat OpenShift GitOps 1.9", "release_date": "2023-06-09T00:00:00Z"}, {"advisory": "RHSA-2022:6351", "cpe": "cpe:/a:redhat:container_native_virtualization:4.10::el8", "package": "container-native-virtualization/virt-api:v4.10.5-3", "product_name": "RHEL-8-CNV-4.10", "release_date": "2022-09-06T00:00:00Z"}, {"advisory": "RHSA-2022:6351", "cpe": "cpe:/a:redhat:container_native_virtualization:4.10::el8", "package": "container-native-virtualization/virt-artifacts-server:v4.10.5-3", "product_name": "RHEL-8-CNV-4.10", "release_date": "2022-09-06T00:00:00Z"}, {"advisory": "RHSA-2022:6351", "cpe": "cpe:/a:redhat:container_native_virtualization:4.10::el8", "package": "container-native-virtualization/virt-controller:v4.10.5-3", "product_name": "RHEL-8-CNV-4.10", "release_date": "2022-09-06T00:00:00Z"}, {"advisory": "RHSA-2022:6351", "cpe": "cpe:/a:redhat:container_native_virtualization:4.10::el8", "package": "container-native-virtualization/virt-handler:v4.10.5-3", "product_name": "RHEL-8-CNV-4.10", "release_date": "2022-09-06T00:00:00Z"}, {"advisory": "RHSA-2022:6351", "cpe": "cpe:/a:redhat:container_native_virtualization:4.10::el8", "package": "container-native-virtualization/virt-launcher:v4.10.5-3", "product_name": "RHEL-8-CNV-4.10", "release_date": "2022-09-06T00:00:00Z"}, {"advisory": "RHSA-2022:6351", "cpe": "cpe:/a:redhat:container_native_virtualization:4.10::el8", "package": "container-native-virtualization/virt-operator:v4.10.5-3", "product_name": "RHEL-8-CNV-4.10", "release_date": "2022-09-06T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/cluster-network-addons-operator:v4.9.7-4", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/hostpath-provisioner-rhel8:v4.9.7-3", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/hostpath-provisioner-rhel8-operator:v4.9.7-4", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/hyperconverged-cluster-webhook-rhel8:v4.9.7-4", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/kubemacpool:v4.9.7-4", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/kubevirt-ssp-operator:v4.9.7-4", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/kubevirt-vmware:v4.9.7-2", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/libguestfs-tools:v4.9.7-5", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/node-maintenance-operator:v4.9.7-4", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/virt-cdi-cloner:v4.9.7-3", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}, {"advisory": "RHSA-2022:8609", "cpe": "cpe:/a:redhat:container_native_virtualization:4.9::el8", "package": "container-native-virtualization/vm-import-virtv2v-rhel8:v4.9.7-4", "product_name": "RHEL-8-CNV-4.9", "release_date": "2022-11-22T00:00:00Z"}], "bugzilla": {"description": "go-restful: Authorization Bypass Through User-Controlled Key", "id": "2094982", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2094982"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-639", "details": ["Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.", "A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data on behalf of users."], "name": "CVE-2022-1996", "package_state": [{"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "helm", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Will not fix", "package_name": "odo", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines-client", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "CLI", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "knative-eventing", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:service_mesh:2.0", "fix_state": "Not affected", "package_name": "servicemesh", "product_name": "OpenShift Service Mesh 2.0"}, {"cpe": "cpe:/a:redhat:service_mesh:2.1", "fix_state": "Not affected", "package_name": "servicemesh", "product_name": "OpenShift Service Mesh 2.1"}, {"cpe": "cpe:/a:redhat:service_mesh:2.1", "fix_state": "Not affected", "package_name": "servicemesh-prometheus", "product_name": "OpenShift Service Mesh 2.1"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-rhel7-operator", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform", "fix_state": "Will not fix", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 1.2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Will not fix", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "ansible-service-broker", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "atomic-enterprise-service-catalog", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "atomic-openshift", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "atomic-openshift-descheduler", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "atomic-openshift-dockerregistry", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "atomic-openshift-service-idler", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Not affected", "package_name": "atomic-openshift-web-console", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Will not fix", "package_name": "golang-github-openshift-oauth-proxy", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Not affected", "package_name": "openshift-enterprise-cluster-capacity", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Not affected", "package_name": "podman", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "atomic-enterprise-service-catalog", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "atomic-openshift-service-idler", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "cri-o", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "machine-config-daemon", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "openshift", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "openshift-clients", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Will not fix", "package_name": "mcg", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Will not fix", "package_name": "mcg", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "kubevirt", "product_name": "Red Hat OpenShift Virtualization 4"}], "public_date": "2022-06-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-1996\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-1996"], "statement": "The go-restful package is a transitive dependency which is being pulled with k8s.io/api and not directly being used anywhere in OpenShift Container Platform (OCP), OpenShift Container Storage and OpenShift Data Foundation, hence these components are marked as 'Will not fix' or even \"Not affected\".", "threat_severity": "Important", "upstream_fix": "go-restful 3.8.0"}