USN-8983-1: golang-github-gin-contrib-cors vulnerability
It was discovered that the Gin CORS middleware incorrectly handled wildcards at the end of origin strings. A remote attacker could possibly use this issue to bypass the configured origin restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-corsto a version that resolves this vulnerability.Fixed in 1.3.0-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-corsto a version that resolves this vulnerability.Fixed in 1.3.1-1+deb11u1build0.22.04.1 - Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-corsto a version that resolves this vulnerability.Fixed in 1.4.0-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-cors-devto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/golang-github-gin-contrib-cors-devto a version that resolves this vulnerability.Fixed in 1.3.1-1+deb11u1build0.22.04.1
Event History
Frequently Asked Questions
Which environments are potentially exposed?
Ubuntu systems using golang-github-gin-contrib-cors or golang-github-gin-contrib-cors-dev may be exposed if their applications rely on configured CORS origin restrictions.
What level of attacker access is identified?
The issue may be exploitable by a remote attacker. The provided information does not state any authentication or local-access prerequisite.
Are fixed versions or temporary mitigations provided?
No fixed package versions or interim mitigation steps are included in the provided notice data.