~ / search / GHSA-v9mp-j8g7-2q6m

GHSA-v9mp-j8g7-2q6m

Paranoidhttp Server-Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-24623

Packages

EcosystemPackageAffectedFixed in
Go github.com/hakobe/paranoidhttp < 0.3.0 0.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.

References

External links from the advisory. They lead to third-party sites.