CVE-2019-25211: Critical severity go/github.com/gin-contrib/cors vulnerability
Gin-Gonic CORS middleware mishandles a wildcard at the end of an origin string. Examples: https://example.community/ is accepted by the origin string https://example.com/ and http://localhost.example.com/ is accepted by the origin string http://localhost/ .
Other sources
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/ is allowed when the intention is that only https://example.com/ should be allowed, and http://localhost.example.com/ is allowed when the intention is that only http://localhost/ should be allowed.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/gin-contrib/corsto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
go/github.com/gin-gonic/ginto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-corsto a version that resolves this vulnerability.Fixed in 1.3.0-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-corsto a version that resolves this vulnerability.Fixed in 1.3.1-1+deb11u1build0.22.04.1 - Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-corsto a version that resolves this vulnerability.Fixed in 1.4.0-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25211?
CVE-2019-25211 has a medium severity rating that could allow unauthorized access through improper CORS validation.
How do I fix CVE-2019-25211?
To fix CVE-2019-25211, update to the Gin-Gonic CORS middleware version 1.6.0 or later.
Which software is affected by CVE-2019-25211?
CVE-2019-25211 affects the Gin-Gonic CORS middleware in versions prior to 1.6.0.
What is the nature of the vulnerability in CVE-2019-25211?
CVE-2019-25211 is a cross-origin resource sharing issue that mishandles wildcards in the origin string.
Can CVE-2019-25211 lead to security breaches?
Yes, CVE-2019-25211 can lead to security breaches by allowing unauthorized access to resources.