CVE-2020-36567: Arbitrary log line injection in github.com/gin-gonic/gin
A flaw was found in gin. This issue occurs when the default Formatter for the Logger middleware (LoggerConfig.Formatter), which is included in the Default engine, allows attackers to inject arbitrary log entries by manipulating the request path.
Other sources
Gin-Gonic Gin Web Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation by the default logger. By sending a specially-crafted request, an attacker could exploit this vulnerability to inject arbitrary log lines.
— IBM
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-36567?
CVE-2020-36567 is a vulnerability in github.com/gin-gonic/gin before v1.6.0 that allows remote attackers to inject arbitrary log entries by manipulating the request path.
What is the severity of CVE-2020-36567?
CVE-2020-36567 has a severity rating of 7.5 (High).
How does CVE-2020-36567 affect the gin-gonic/gin package?
CVE-2020-36567 affects the gin-gonic/gin package before version 1.6.0.
How can I fix CVE-2020-36567?
To fix CVE-2020-36567, update the gin-gonic/gin package to version 1.6.0 or later.
Where can I find more information about CVE-2020-36567?
You can find more information about CVE-2020-36567 in the following references: [CVE](https://www.cve.org/CVERecord?id=CVE-2020-36567), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-36567), [GitHub Commit](https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d), [GitHub Pull Request](https://github.com/gin-gonic/gin/pull/2237), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2156683), [Red Hat Errata](https://access.redhat.com/errata/RHSA-2023:0934), [GO-2020-0001](https://pkg.go.dev/vuln/GO-2020-0001).