Skip to content

Commit 5b8657f

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: add GO-2024-3098
 - data/reports/GO-2024-3098.yaml Fixes #3098 Change-Id: Ib825ff7ad0ce477240d44355b00b37befdd6eae4 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/613257 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]>
1 parent d0b10b7 commit 5b8657f

File tree

2 files changed

+228
-0
lines changed

2 files changed

+228
-0
lines changed

‎data/osv/GO-2024-3098.json

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-3098",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-45258",
8+
"GHSA-cj55-gc7m-wvcq"
9+
],
10+
"summary": "The req library may send an unintended request when a malformed URL is provided in github.com/imroc/req",
11+
"details": "The req library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in applications relying on this library for handling HTTP requests.\n\nDespite developers potentially utilizing the net/url library to parse malformed URLs and implement blocklists to prevent HTTP requests to listed URLs, inconsistencies exist between how the net/url and req libraries parse URLs. These discrepancies can lead to the failure of defensive strategies, resulting in potential security threats such as Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE).",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/imroc/req",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
}
25+
]
26+
}
27+
],
28+
"ecosystem_specific": {
29+
"imports": [
30+
{
31+
"path": "github.com/imroc/req"
32+
}
33+
]
34+
}
35+
},
36+
{
37+
"package": {
38+
"name": "github.com/imroc/req/v2",
39+
"ecosystem": "Go"
40+
},
41+
"ranges": [
42+
{
43+
"type": "SEMVER",
44+
"events": [
45+
{
46+
"introduced": "0"
47+
}
48+
]
49+
}
50+
],
51+
"ecosystem_specific": {
52+
"imports": [
53+
{
54+
"path": "github.com/imroc/req/v2"
55+
}
56+
]
57+
}
58+
},
59+
{
60+
"package": {
61+
"name": "github.com/imroc/req/v3",
62+
"ecosystem": "Go"
63+
},
64+
"ranges": [
65+
{
66+
"type": "SEMVER",
67+
"events": [
68+
{
69+
"introduced": "0"
70+
},
71+
{
72+
"fixed": "3.43.4"
73+
}
74+
]
75+
}
76+
],
77+
"ecosystem_specific": {
78+
"imports": [
79+
{
80+
"path": "github.com/imroc/req/v3",
81+
"symbols": [
82+
"Delete",
83+
"Get",
84+
"Head",
85+
"HttpRoundTripFunc.RoundTrip",
86+
"MustDelete",
87+
"MustGet",
88+
"MustHead",
89+
"MustOptions",
90+
"MustPatch",
91+
"MustPost",
92+
"MustPut",
93+
"Options",
94+
"ParallelDownload.Do",
95+
"Patch",
96+
"Post",
97+
"Put",
98+
"Request.Delete",
99+
"Request.Do",
100+
"Request.Get",
101+
"Request.Head",
102+
"Request.MustDelete",
103+
"Request.MustGet",
104+
"Request.MustHead",
105+
"Request.MustOptions",
106+
"Request.MustPatch",
107+
"Request.MustPost",
108+
"Request.MustPut",
109+
"Request.Options",
110+
"Request.Patch",
111+
"Request.Post",
112+
"Request.Put",
113+
"Request.Send",
114+
"Transport.CancelRequest",
115+
"Transport.CloseIdleConnections",
116+
"Transport.RoundTrip",
117+
"cleanHost",
118+
"persistConn.writeRequest",
119+
"roundTripImpl.RoundTrip"
120+
]
121+
}
122+
]
123+
}
124+
}
125+
],
126+
"references": [
127+
{
128+
"type": "ADVISORY",
129+
"url": "https://github.com/advisories/GHSA-cj55-gc7m-wvcq"
130+
},
131+
{
132+
"type": "FIX",
133+
"url": "https://github.com/imroc/req/commit/04e3ece5b380ecad9da3551c449f1b8a9aa76d3d"
134+
},
135+
{
136+
"type": "WEB",
137+
"url": "https://github.com/imroc/req/compare/v3.43.3...v3.43.4"
138+
}
139+
],
140+
"database_specific": {
141+
"url": "https://pkg.go.dev/vuln/GO-2024-3098",
142+
"review_status": "REVIEWED"
143+
}
144+
}

‎data/reports/GO-2024-3098.yaml

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
id: GO-2024-3098
2+
modules:
3+
- module: github.com/imroc/req
4+
vulnerable_at: 0.3.2
5+
packages:
6+
- package: github.com/imroc/req
7+
- module: github.com/imroc/req/v2
8+
vulnerable_at: 2.1.0
9+
packages:
10+
- package: github.com/imroc/req/v2
11+
- module: github.com/imroc/req/v3
12+
versions:
13+
- fixed: 3.43.4
14+
vulnerable_at: 3.43.3
15+
packages:
16+
- package: github.com/imroc/req/v3
17+
symbols:
18+
- cleanHost
19+
- persistConn.writeRequest
20+
derived_symbols:
21+
- Delete
22+
- Get
23+
- Head
24+
- HttpRoundTripFunc.RoundTrip
25+
- MustDelete
26+
- MustGet
27+
- MustHead
28+
- MustOptions
29+
- MustPatch
30+
- MustPost
31+
- MustPut
32+
- Options
33+
- ParallelDownload.Do
34+
- Patch
35+
- Post
36+
- Put
37+
- Request.Delete
38+
- Request.Do
39+
- Request.Get
40+
- Request.Head
41+
- Request.MustDelete
42+
- Request.MustGet
43+
- Request.MustHead
44+
- Request.MustOptions
45+
- Request.MustPatch
46+
- Request.MustPost
47+
- Request.MustPut
48+
- Request.Options
49+
- Request.Patch
50+
- Request.Post
51+
- Request.Put
52+
- Request.Send
53+
- Transport.CancelRequest
54+
- Transport.CloseIdleConnections
55+
- Transport.RoundTrip
56+
- roundTripImpl.RoundTrip
57+
summary: |-
58+
The req library may send an unintended request when a malformed URL is provided
59+
in github.com/imroc/req
60+
description: |-
61+
The req library is a widely used HTTP library in Go. However, it does not handle
62+
malformed URLs effectively. As a result, after parsing a malformed URL, the
63+
library may send HTTP requests to unexpected destinations, potentially leading
64+
to security vulnerabilities or unintended behavior in applications relying on
65+
this library for handling HTTP requests.
66+
67+
Despite developers potentially utilizing the net/url library to parse malformed
68+
URLs and implement blocklists to prevent HTTP requests to listed URLs,
69+
inconsistencies exist between how the net/url and req libraries parse URLs.
70+
These discrepancies can lead to the failure of defensive strategies, resulting
71+
in potential security threats such as Server-Side Request Forgery (SSRF) and
72+
Remote Code Execution (RCE).
73+
cves:
74+
- CVE-2024-45258
75+
ghsas:
76+
- GHSA-cj55-gc7m-wvcq
77+
references:
78+
- advisory: https://github.com/advisories/GHSA-cj55-gc7m-wvcq
79+
- fix: https://github.com/imroc/req/commit/04e3ece5b380ecad9da3551c449f1b8a9aa76d3d
80+
- web: https://github.com/imroc/req/compare/v3.43.3...v3.43.4
81+
source:
82+
id: GHSA-cj55-gc7m-wvcq
83+
created: 2024-09-13T15:12:56.781299-04:00
84+
review_status: REVIEWED

0 commit comments

Comments
 (0)