CVE-2022-32190

Aliases:GO-2022-0988BIT-golang-2022-32190RHBA-2023:0568DEBIAN-CVE-2022-32190CGA-274g-x6gp-9q5xCGA-2m5j-fxhh-cmhgCGA-38q8-ffxg-3h24CGA-4gf7-7wj9-5f9hCGA-4j69-v98q-6wmhCGA-9q99-9629-ghr5CGA-ch25-mrpr-fg64CGA-g353-8574-gcv9CGA-gw2q-73vx-f4jrCGA-h24h-8h8p-435cCGA-hfxj-h277-q4gpCGA-mgv5-v2xp-c9h4CGA-p3fx-84qm-g9c7CGA-pm3v-m96p-hr9vCGA-q7mx-cv79-q8pwCGA-rmgm-xv6x-445mCGA-w7cj-vq84-45fxCGA-xhcw-v9rv-j4ghCGA-279w-jwwc-67g8CGA-wg6x-jxq2-w97f
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 13 Sept 2022, 17:08
Last modified:03 Aug 2024, 07:32

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
2.15% LOW
2% probability +1.98%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Sept 2022, 17:08
Published
Vulnerability first disclosed
03 Aug 2024, 07:32
Last Modified
Vulnerability information updated

Description

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 2.15%• Percentile: 81%

Techniques & Countermeasures

  • CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected Systems

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    < 0.19.0-r40

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • wolfi•katib-earlystopping

    < 0.19.0-r31

  • wolfi•katib-suggestion-goptuna-compat

    < 0.19.0-r40

  • wolfi•katib-suggestion-hyperband

    < 0.19.0-r31

  • wolfi•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • wolfi•katib-suggestion-nas-darts

    < 0.19.0-r31

  • wolfi•katib-suggestion-nas-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • wolfi•katib-tfevent-metricscollector

    < 0.19.0-r31

  • debian•golang-1.19

    < 1.19.1-1

  • go standard library•net/url

    ≥ 1.19.0-0, < 1.19.1

  • golang•go

    1.19.0 | 1.19.0:beta1 | 1.19.0:rc1 | 1.19.0:rc2

  • Go•stdlib

    ≥ 1.19.0-0, < 1.19.1

  • redhat•atomic-openshift-service-idler

    < 0:4.12.0-202301312133.p0.ga0f9090.assembly.stream.el8

  • redhat•bpftool

    < 0:4.18.0-372.43.1.el8_6

  • redhat•bpftool-debuginfo

    < 0:4.18.0-372.43.1.el8_6

  • redhat•buildah

    < 1:1.23.4-3.rhaos4.12.el8

  • redhat•buildah-debuginfo

    < 1:1.23.4-3.rhaos4.12.el8

  • redhat•buildah-debugsource

    < 1:1.23.4-3.rhaos4.12.el8

  • redhat•buildah-tests

    < 1:1.23.4-3.rhaos4.12.el8

  • redhat•buildah-tests-debuginfo

    < 1:1.23.4-3.rhaos4.12.el8

  • redhat•containers-common

    < 2:1-32.rhaos4.12.el8

  • redhat•kernel

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-core

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-cross-headers

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debug

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debug-core

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debug-debuginfo

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debug-devel

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debug-modules

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debug-modules-extra

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debug-modules-internal

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debuginfo

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debuginfo-common-aarch64

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debuginfo-common-ppc64le

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debuginfo-common-s390x

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-debuginfo-common-x86_64

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-devel

    < 0:4.18.0-372.43.1.el8_6

  • redhat•kernel-doc

    < 0:4.18.0-372.43.1.el8_6

Showing first 50 affected entries in server-rendered view.

References (15)