High severity - HTTP Response Splitting vulnerability in github.com/gin-gonic/gin

[scott-es]

• Package Manager: gomodules
• Vulnerable module: github.com/gin-gonic/gin
• Introduced through: github.com/Contrast-Security-OSS/go-test-bench@0.0.0 and github.com/gin-gonic/gin@1.7.4

Detailed paths

• Introduced through: github.com/Contrast-Security-OSS/go-test-bench@0.0.0 › github.com/gin-gonic/gin@1.7.4
• Introduced through: github.com/Contrast-Security-OSS/go-test-bench@0.0.0 › github.com/gin-contrib/multitemplate@#8a2f6dd269a0 › github.com/gin-gonic/gin@1.7.4

Overview

github.com/gin-gonic/gin is a package that implements a HTTP web framework called gin.

Affected versions of this package are vulnerable to HTTP Response Splitting. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.

Remediation

Upgrade github.com/gin-gonic/gin to version 1.7.7 or higher.

References

• GitHub Issue
• GitHub Release