~ / search / GHSA-h395-qcrw-5vmq

GHSA-h395-qcrw-5vmq

Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin

Source: GitHub Advisory Database (reviewed) High CVE-2020-28483

Packages

EcosystemPackageAffectedFixed in
Go github.com/gin-gonic/gin < 1.7.7 1.7.7

Details

As written in the advisory (Markdown source, shown as plain text).

When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7.

References

External links from the advisory. They lead to third-party sites.