CVE-2022-32190: Failure to strip relative path components in net/url
A flaw was found in the golang package. The JoinPath doesn't remove the ../ path components appended to a domain that is not terminated by a slash, possibly leading to a directory traversal attack.
Other sources
Golang Go could allow a remote attacker to traverse directories on the system, caused by not remove ../ path elements appended to a relative path in JoinPath and URL.JoinPath. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
— IBM
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
JoinPath and URL.JoinPath would not remove ../ path components appended to a relative path. For example, JoinPath("https://go.dev", "../go") returned the URL https://go.dev/../go, despite the JoinPath documentation stating that ../ path elements are cleaned from the result.
References: https://go.dev/issue/54385 https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ
Upstream Commits: Master : https://github.com/golang/go/commit/0765da5884adcc8b744979303a36a27092d8fc51 Branch.go1.19 : https://github.com/golang/go/commit/28335508913a46e05ef0c04a18e8a1a6beb775ec
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-clientsto a version that resolves this vulnerability.Fixed in 0:4.12.0-202301042257.p0.g854f807.assembly.stream.el8 - Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 3:4.2.0-7.rhaos4.12.el9 - Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 3:1.1.6-4.rhaos4.12.el8 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.13.0-1469.el7 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.13.0-1469.el8 - Upgrade
Upgrade
redhat/kubevirtto a version that resolves this vulnerability.Fixed in 0:4.13.0-1469.el9 - Upgrade
Upgrade
redhat/golangto a version that resolves this vulnerability.Fixed in 1.19.1 - Upgrade
Upgrade
debian/golang-1.19to a version that resolves this vulnerability.Fixed in 1.19.8-2 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.18.6-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.19.1-r0 - Upgrade
Upgrade
debian/golang-1.19to a version that resolves this vulnerability.Fixed in 1.19.1-1 - Upgrade
Upgrade
golangto a version that resolves this vulnerability.Patch 28335508913a46e05ef0c04a18e8a1a6beb775ec - Upgrade
Upgrade
golangto a version that resolves this vulnerability.Patch 0765da5884adcc8b744979303a36a27092d8fc51
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID of this flaw in the golang package?
The vulnerability ID is CVE-2022-32190.
What is the severity of CVE-2022-32190?
The severity of CVE-2022-32190 is high.
How does JoinPath and URL.JoinPath in the golang package behave in the presence of ../ path elements?
JoinPath and URL.JoinPath in the golang package do not remove ../ path elements from the result.
Are there any known remedies for this vulnerability?
Yes, there are known remedies for this vulnerability.
Where can I find more information about CVE-2022-32190?
You can find more information about CVE-2022-32190 on the CVE website, NVD, GitHub Go issue, Google Groups announcement, Red Hat Bugzilla, and Red Hat Access website.