logo

Database

HTTP request smuggling In github.com/gin-gonic/gin

Description

Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-284832. NVD-2020-284833. OSV-DEBIAN-2020-284834. OSV-2020-284835. GCVE-2020-284836. SECURITY-TRACKER-CVE-2020-28483

References

1. https://github.com/gin-gonic/gin/issues/22322. https://github.com/gin-gonic/gin/issues/24733. https://github.com/gin-gonic/gin/issues/28624. https://github.com/gin-gonic/gin/pull/24745. https://github.com/gin-gonic/gin/pull/2474#23issuecomment-7296964376. https://github.com/gin-gonic/gin/pull/26327. https://github.com/gin-gonic/gin/pull/26758. https://github.com/gin-gonic/gin/pull/28449. https://github.com/gin-gonic/gin/pull/2844/files#diff-e6ce689a25eaef174c2dd51fe869fabbe04a6c6afbd416b23eda138c82e761baR143210. https://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd911. https://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de893712. https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd26063671113. https://pkg.go.dev/vuln/GO-2021-005214. https://github.com/gin-gonic/gin/releases/tag/v1.7.715. https://github.com/gin-gonic/gin/releases/tag/v1.7.0

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.