Security vulnerability identified with all current releases of gin CVE-2020-28483

[stevesim101]

Description

Current versions of gin are affected by CVE-2020-28483.
https://nvd.nist.gov/vuln/detail/CVE-2020-28483

How to reproduce

N/A

Expectations

Looking for a new release of gin that resolves the identified vulnerability.

Actual result

N/A

Environment

• go version: 1.14.4 and higher
• gin version (or commit ref):
• operating system:

[montanaflynn]

What's the actual security implication here? Getting the wrong IP doesn't seem like a security risk, it's like saying users can spoof their user agent. Seeing comments like "// (insecure!) old behaviour)" has me thinking maybe I'm missing something.

I'm really relieved that the default behavior isn't changing because many gin servers can only be reached through a trusted proxy and it would be very difficult to add all the IPs to the TrustedProxies if you're behind a global CDN like cloudfront, whose IP addresses presumably are changing and being added to so often that there's a JSON API enumerating them:

http://d7uri8nf7uskq.cloudfront.net/tools/list-cloudfront-ips

[madhupavan]

@appleboy @manucorporat Now that this CVE is fixed, are we planning a release in near future.
Any information on the release cycle would be highly appreciated.
Thank you!

[gliptak]

#2632 was included in https://github.com/gin-gonic/gin/releases/tag/v1.7.0

[thinkerou]

v1.7.7 have released, thanks! https://github.com/gin-gonic/gin/releases