diff --git a/data/reports/GO-2021-0052.yaml b/data/reports/GO-2021-0052.yaml index 0bbb731f..609a0ce5 100644 --- a/data/reports/GO-2021-0052.yaml +++ b/data/reports/GO-2021-0052.yaml @@ -1,11 +1,22 @@ modules: - module: github.com/gin-gonic/gin versions: - - fixed: 1.6.3-0.20210406033725-bfc8ca285eb4 + - fixed: 1.7.7 + vulnerable_at: 1.7.6 packages: - package: github.com/gin-gonic/gin symbols: - Context.ClientIP + - Context.RemoteIP + derived_symbols: + - Context.Next + - Engine.HandleContext + - Engine.Run + - Engine.RunFd + - Engine.RunListener + - Engine.RunTLS + - Engine.RunUnix + - Engine.ServeHTTP description: | Due to improper HTTP header santization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow @@ -15,8 +26,15 @@ cves: - CVE-2020-28483 ghsas: - GHSA-h395-qcrw-5vmq -credit: '@sorenh' +credit: '@sorenisanerd' references: + - report: https://github.com/gin-gonic/gin/issues/2862 + - report: https://github.com/gin-gonic/gin/issues/2473 + - report: https://github.com/gin-gonic/gin/issues/2232 + - fix: https://github.com/gin-gonic/gin/pull/2844 + - fix: https://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937 - fix: https://github.com/gin-gonic/gin/pull/2632 - fix: https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711 + - fix: https://github.com/gin-gonic/gin/pull/2675 + - fix: https://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9 - web: https://github.com/gin-gonic/gin/pull/2474