Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

Project Subscriptions

Vendors Products
Ceph Storage Subscribe
Container Native Virtualization Subscribe
Devtools Subscribe
Enterprise Linux Subscribe
Logging Subscribe
Ocp Tools Subscribe
Openshift Subscribe
Openshift Api Data Protection Subscribe
Openshift Custom Metrics Autoscaler Subscribe
Openshift Data Foundation Subscribe
Openshift Secondary Scheduler Subscribe
Openshift Serverless Subscribe
Openstack Subscribe
Rhosemc Subscribe
Serverless Subscribe
Service Interconnect Subscribe
Service Mesh Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2022-35112 Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Ubuntu USN Ubuntu USN USN-6038-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-6038-2 Go vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-02-13T16:32:39.111Z

Reserved: 2022-08-17T00:00:00.000Z

Link: CVE-2022-2880

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-10-14T15:15:18.090

Modified: 2024-11-21T07:01:51.610

Link: CVE-2022-2880

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-10-04T00:00:00Z

Links: CVE-2022-2880 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses