Description
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Published: 2022-10-14
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-35112 Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.
Ubuntu USN Ubuntu USN USN-6038-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-6038-2 Go vulnerabilities
History

No history.

Subscriptions

Golang Go
Redhat Acm Ceph Storage Container Native Virtualization Devtools Enterprise Linux Logging Ocp Tools Openshift Openshift Api Data Protection Openshift Custom Metrics Autoscaler Openshift Data Foundation Openshift Secondary Scheduler Openshift Serverless Openstack Rhmt Rhosemc Serverless Service Interconnect Service Mesh
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-02-13T16:32:39.111Z

Reserved: 2022-08-17T00:00:00.000Z

Link: CVE-2022-2880

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-10-14T15:15:18.090

Modified: 2024-11-21T07:01:51.610

Link: CVE-2022-2880

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-10-04T00:00:00Z

Links: CVE-2022-2880 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses