CVE-2022-32190: Failure to strip relative path components in net/url

Modified

AliasesRHBA-2023:0568DEBIAN-CVE-2022-32190CGA-274g-x6gp-9q5x+22 more

Published 13-09-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-32190 is a high (CVSS 7.5) vulnerability in go standard library net/url. EPSS estimates a 2.15% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

2.15%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 3

MGASA-2022-0356 OPENSUSE-SU-2024:12310-1 RHSA-2022:7398 RHSA-2023:3204 RHSA-2023:3613 SUSE-SU-2022:3326-1+1 more

Timeline

13-09-2022
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.5

EPSS trend

Probability

2.15%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.15% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat88 products

atomic-openshift-service-idler< 0:4.12.0-202301312133.p0.ga0f9090.assembly.stream.el8
bpftool< 0:4.18.0-372.43.1.el8_6
bpftool-debuginfo< 0:4.18.0-372.43.1.el8_6
buildah< 1:1.23.4-3.rhaos4.12.el8
buildah-debuginfo< 1:1.23.4-3.rhaos4.12.el8

buildah-debugsource< 1:1.23.4-3.rhaos4.12.el8
buildah-tests< 1:1.23.4-3.rhaos4.12.el8
buildah-tests-debuginfo< 1:1.23.4-3.rhaos4.12.el8
containers-common< 2:1-32.rhaos4.12.el8
kernel< 0:4.18.0-372.43.1.el8_6
kernel-core< 0:4.18.0-372.43.1.el8_6
kernel-cross-headers< 0:4.18.0-372.43.1.el8_6
kernel-debug< 0:4.18.0-372.43.1.el8_6
kernel-debug-core< 0:4.18.0-372.43.1.el8_6
kernel-debug-debuginfo< 0:4.18.0-372.43.1.el8_6
kernel-debug-devel< 0:4.18.0-372.43.1.el8_6
kernel-debug-modules< 0:4.18.0-372.43.1.el8_6
kernel-debug-modules-extra< 0:4.18.0-372.43.1.el8_6
kernel-debug-modules-internal< 0:4.18.0-372.43.1.el8_6
kernel-debuginfo< 0:4.18.0-372.43.1.el8_6
kernel-debuginfo-common-aarch64< 0:4.18.0-372.43.1.el8_6
kernel-debuginfo-common-ppc64le< 0:4.18.0-372.43.1.el8_6
kernel-debuginfo-common-s390x< 0:4.18.0-372.43.1.el8_6
kernel-debuginfo-common-x86_64< 0:4.18.0-372.43.1.el8_6
kernel-devel< 0:4.18.0-372.43.1.el8_6
kernel-doc< 0:4.18.0-372.43.1.el8_6
kernel-headers< 0:4.18.0-372.43.1.el8_6
kernel-ipaclones-internal< 0:4.18.0-372.43.1.el8_6
kernel-modules< 0:4.18.0-372.43.1.el8_6
kernel-modules-extra< 0:4.18.0-372.43.1.el8_6
kernel-modules-internal< 0:4.18.0-372.43.1.el8_6
kernel-rt< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-core< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug-core< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug-debuginfo< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug-devel< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug-kvm< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug-modules< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug-modules-extra< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debug-modules-internal< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debuginfo< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-debuginfo-common-x86_64< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-devel< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-kvm< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-modules< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-modules-extra< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-modules-internal< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-rt-selftests-internal< 0:4.18.0-372.41.1.rt7.198.el8_6
kernel-selftests-internal< 0:4.18.0-372.43.1.el8_6
kernel-tools< 0:4.18.0-372.43.1.el8_6
kernel-tools-debuginfo< 0:4.18.0-372.43.1.el8_6
kernel-tools-libs< 0:4.18.0-372.43.1.el8_6
kernel-tools-libs-devel< 0:4.18.0-372.43.1.el8_6
kernel-zfcpdump< 0:4.18.0-372.43.1.el8_6
kernel-zfcpdump-core< 0:4.18.0-372.43.1.el8_6
kernel-zfcpdump-debuginfo< 0:4.18.0-372.43.1.el8_6
kernel-zfcpdump-devel< 0:4.18.0-372.43.1.el8_6
kernel-zfcpdump-modules< 0:4.18.0-372.43.1.el8_6
kernel-zfcpdump-modules-extra< 0:4.18.0-372.43.1.el8_6
kernel-zfcpdump-modules-internal< 0:4.18.0-372.43.1.el8_6
openshift-clients< 0:4.12.0-202301311516.p0.gb05f7d4.assembly.stream.el8 | < 0:4.12.0-202301311516.p0.gb05f7d4.assembly.stream.el9
openshift-clients-redistributable< 0:4.12.0-202301311516.p0.gb05f7d4.assembly.stream.el8 | < 0:4.12.0-202301311516.p0.gb05f7d4.assembly.stream.el9
openshift-kuryr< 0:4.12.0-202301312133.p0.g92b9be2.assembly.stream.el8
openshift-kuryr-cni< 0:4.12.0-202301312133.p0.g92b9be2.assembly.stream.el8
openshift-kuryr-common< 0:4.12.0-202301312133.p0.g92b9be2.assembly.stream.el8
openshift-kuryr-controller< 0:4.12.0-202301312133.p0.g92b9be2.assembly.stream.el8
ovn22.12< 0:22.12.0-18.el8fdp
ovn22.12-central< 0:22.12.0-18.el8fdp
ovn22.12-central-debuginfo< 0:22.12.0-18.el8fdp
ovn22.12-debuginfo< 0:22.12.0-18.el8fdp
ovn22.12-debugsource< 0:22.12.0-18.el8fdp
ovn22.12-host< 0:22.12.0-18.el8fdp
ovn22.12-host-debuginfo< 0:22.12.0-18.el8fdp
ovn22.12-vtep< 0:22.12.0-18.el8fdp
ovn22.12-vtep-debuginfo< 0:22.12.0-18.el8fdp
perf< 0:4.18.0-372.43.1.el8_6
perf-debuginfo< 0:4.18.0-372.43.1.el8_6
python3-kuryr-kubernetes< 0:4.12.0-202301312133.p0.g92b9be2.assembly.stream.el8
python3-perf< 0:4.18.0-372.43.1.el8_6
python3-perf-debuginfo< 0:4.18.0-372.43.1.el8_6
runc< 3:1.1.4-1.rhaos4.12.el8
runc-debuginfo< 3:1.1.4-1.rhaos4.12.el8
runc-debugsource< 3:1.1.4-1.rhaos4.12.el8
skopeo< 2:1.9.4-1.rhaos4.12.el8 | < 2:1.9.4-1.rhaos4.12.el9
skopeo-debuginfo< 2:1.9.4-1.rhaos4.12.el8 | < 2:1.9.4-1.rhaos4.12.el9
skopeo-debugsource< 2:1.9.4-1.rhaos4.12.el8 | < 2:1.9.4-1.rhaos4.12.el9
skopeo-tests< 2:1.9.4-1.rhaos4.12.el8 | < 2:1.9.4-1.rhaos4.12.el9

Show all 88

Chainguard10 products

katib-earlystopping< 0.19.0-r31
katib-suggestion-goptuna-compat< 0.19.0-r40
katib-suggestion-hyperband< 0.19.0-r31
katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
katib-suggestion-nas-darts< 0.19.0-r31

Show all 10

Wolfi10 products

katib-earlystopping< 0.19.0-r31
katib-suggestion-goptuna-compat< 0.19.0-r40
katib-suggestion-hyperband< 0.19.0-r31
katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
katib-suggestion-nas-darts< 0.19.0-r31

Show all 10

Alpine1 product

go< 1.18.6-r0 | < 1.19.1-r0

Debian1 product

golang-1.19< 1.19.1-1

Go1 product

stdlib≥ 1.19.0-0, < 1.19.1

Go standard library1 product

net/url≥ 1.19.0-0, < 1.19.1

Golang1 product

goEOL1.19.0 | 1.19.0:beta1 | 1.19.0:rc1 | 1.19.0:rc2

8 vendors · 113 products

References

16 links

groups.google.com/g/golang-announce/c/x49AQzIVX-sAdvisoryWEBMailing ListThird Party Advisory
go.dev/issue/54385ARTICLEFIXREPORTIssue TrackingPatchVendor Advisory
go.dev/cl/423514FIXPatchRelease Notes
pkg.go.dev/vuln/GO-2022-0988FIXIssue TrackingPatchVendor Advisory
access.redhat.com/errata/RHBA-2023:0568Advisory
issues.redhat.com/browse/OCPBUGS-6900ARTICLE
issues.redhat.com/browse/OCPBUGS-6981ARTICLE
issues.redhat.com/browse/OCPBUGS-6986ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_0568.jsonAdvisory
access.redhat.com/security/cve/CVE-2022-32190REPORT

Show all 16 references

bugzilla.redhat.com/show_bug.cgi?id=2124668REPORT
www.cve.org/CVERecord?id=CVE-2022-32190Advisory
nvd.nist.gov/vuln/detail/CVE-2022-32190Advisory
groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJARTICLE
security-tracker.debian.org/tracker/CVE-2022-32190Advisory
security.alpinelinux.org/vuln/CVE-2022-32190Advisory