CVE-2022-1996
Aliases:GHSA-r48q-9g5r-8q2hGO-2022-0619RHSA-2023:3229RHSA-2023:3557DEBIAN-CVE-2022-1996CGA-22jp-9m7p-j4h7CGA-2hjf-2wg2-hr74CGA-36c5-86g7-hgchCGA-533p-xjg4-7934CGA-62xg-276j-xp7cCGA-6m7j-g4pp-j6h9CGA-6p9c-4f45-vg3xCGA-6v6m-ff9x-48hqCGA-759r-2hvr-3x2qCGA-7m73-4rc8-q79rCGA-7qpw-xjhf-7gprCGA-8fcc-jvx4-8qfqCGA-9g55-xm6w-m2mgCGA-9jmm-rhwr-8xwpCGA-f8p9-vf34-pwhqCGA-h9g2-xgjc-hggcCGA-j5q7-mx4w-953vCGA-m27w-c3qq-m2g2CGA-mm4v-42c9-f7mxCGA-27pv-qx9x-4jr6CGA-2jw8-2rc6-gwqxCGA-3r5h-q92g-xjj4CGA-4r95-p7vc-cx9xCGA-53mc-hhfv-j5j7CGA-5r99-9r22-3pp9CGA-663q-9qxh-j493CGA-6r3q-ch7p-pfmmCGA-78fm-hgmx-c793CGA-9253-qf2p-f7qfCGA-9wrh-63gm-g3xhCGA-cfc8-hjg4-pc64CGA-ff23-98w2-8rc2CGA-h3cp-r2m2-7x9vCGA-h947-pr3c-j8q9CGA-hw7j-vxrc-xrcxCGA-j9mr-2gpc-446pCGA-jv6g-rwvx-c34wCGA-pjcg-8869-gw6fCGA-qjgr-3775-x34jCGA-qqp5-3wrv-94f8CGA-qqw4-px9m-pxh9CGA-r97w-mr6j-67j8CGA-rjm8-mg39-q379CGA-rqrj-3mhq-jfmwCGA-v6hc-529q-f359CGA-v6q4-2j34-q3f2CGA-vj5x-p4p9-j9qqCGA-vjgc-6xmx-x7fcCGA-vvqw-wm7m-9xwhCGA-vw8f-9cpq-qrhfCGA-wfqx-g8p3-54h8CGA-x277-p2w4-ccr2CGA-x3cc-w7mw-88wrCGA-xvvc-rc8m-5qh2
Advisory lineage Upstream: 0 Downstream: 23
Modified
Published: 06 Jun 2022, 00:00
Last modified:03 Aug 2024, 00:24
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.3 CRITICAL
v3.0 (cve.org)
EPSS Score
3.12% LOW
3% probability +2.15%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
06 Jun 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 00:24
Last Modified
Vulnerability information updated
Description
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- v3.0•CRITICAL•Score: 9.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
- v2.0•MEDIUM•Score: 6.4AV:N/AC:L/Au:N/C:P/I:P/A:N
EPSS Trends
Current EPSS score: 3.12%• Percentile: 87%
Techniques & Countermeasures
- CWE-639•Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Affected Systems
- chainguard•kube-state-metrics-2.6
< 2.6.0-r1
- chainguard•kubeflow
< 1.10.0-r3
- chainguard•kubeflow-access-management
< 1.10.0-r3
- chainguard•kubeflow-access-management-compat
< 1.10.0-r3
- chainguard•kubeflow-access-management-fips
< 1.10.0-r2
- chainguard•kubeflow-access-management-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook
< 1.10.0-r3
- chainguard•kubeflow-admission-webhook-compat
< 1.10.0-r3
- chainguard•kubeflow-admission-webhook-fips
< 1.10.0-r2
- chainguard•kubeflow-admission-webhook-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller
< 1.10.0-r3
- chainguard•kubeflow-notebook-controller-compat
< 1.10.0-r3
- chainguard•kubeflow-notebook-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-notebook-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-profile-controller
< 1.10.0-r3
- chainguard•kubeflow-profile-controller-compat
< 1.10.0-r3
- chainguard•kubeflow-profile-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-profile-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller
< 1.10.0-r3
- chainguard•kubeflow-pvcviewer-controller-compat
< 1.10.0-r3
- chainguard•kubeflow-pvcviewer-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-pvcviewer-controller-fips-compat
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller
< 1.10.0-r3
- chainguard•kubeflow-tensorboard-controller-compat
< 1.10.0-r3
- chainguard•kubeflow-tensorboard-controller-fips
< 1.10.0-r2
- chainguard•kubeflow-tensorboard-controller-fips-compat
< 1.10.0-r2
- wolfi•kubeflow
< 1.10.0-r3
- wolfi•kubeflow-access-management
< 1.10.0-r3
- wolfi•kubeflow-access-management-compat
< 1.10.0-r3
- wolfi•kubeflow-admission-webhook
< 1.10.0-r3
- wolfi•kubeflow-admission-webhook-compat
< 1.10.0-r3
- wolfi•kubeflow-notebook-controller
< 1.10.0-r3
- wolfi•kubeflow-notebook-controller-compat
< 1.10.0-r3
- wolfi•kubeflow-profile-controller
< 1.10.0-r3
- wolfi•kubeflow-profile-controller-compat
< 1.10.0-r3
- wolfi•kubeflow-pvcviewer-controller
< 1.10.0-r3
- wolfi•kubeflow-pvcviewer-controller-compat
< 1.10.0-r3
- wolfi•kubeflow-tensorboard-controller
< 1.10.0-r3
- wolfi•kubeflow-tensorboard-controller-compat
< 1.10.0-r3
- debian•golang-github-emicklei-go-restful
all | < 3.10.2-1 | < 3.10.2-1 | < 3.10.2-1
- emicklei•emicklei/go-restful
≥ unspecified, < v3.8.0
- fedoraproject•fedora
35 | 36
- go-restful_project•go-restful
< 2.16.0 | ≥ 3.0.0, < 3.8.0
- github.com/emicklei•go-restful
< 2.16.0+incompatible | < 2.16.0
- github.com/emicklei/go-restful•v2
≥ 2.7.1 | ≤ 2.7.1
- github.com/emicklei/go-restful•v3
≥ 3.0.0, < 3.8.0
- redhat•openshift-gitops-kam
< 0:1.8.3-6.el8 | < 0:1.9.0-102.el8
- redhat•openshift-gitops-kam-redistributable
< 0:1.8.3-6.el8 | < 0:1.9.0-102.el8
References (38)
- https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1
- https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/
- https://security.netapp.com/advisory/ntap-20220923-0005/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1996
- https://github.com/emicklei/go-restful/issues/489
- https://github.com/emicklei/go-restful/commit/926662532deb450272956c7bc573978464aae74e
- https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1
- https://security.netapp.com/advisory/ntap-20220923-0005
- https://pkg.go.dev/vuln/GO-2022-0619
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3
- https://github.com/emicklei/go-restful
- https://access.redhat.com/errata/RHSA-2023:3229
- https://access.redhat.com/security/updates/classification/#important
- https://docs.openshift.com/container-platform/latest/cicd/gitops/understanding-openshift-gitops.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2094982
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3229.json
- https://access.redhat.com/security/cve/CVE-2022-1996
- https://www.cve.org/CVERecord?id=CVE-2022-1996
- https://access.redhat.com/errata/RHSA-2023:3557
- https://docs.openshift.com/container-platform/latest/cicd/gitops/gitops-release-notes.html
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3557.json
- https://security-tracker.debian.org/tracker/CVE-2022-1996
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1996.json