High severity - HTTP Response Splitting vulnerability in github.com/gin-gonic/gin (go.mod)

[scott-es]

• Package Manager: gomodules
• Vulnerable module: github.com/gin-gonic/gin
• Introduced through: github.com/Contrast-Security-OSS/[email protected] and github.com/gin-gonic/[email protected]

Detailed paths

• Introduced through: github.com/Contrast-Security-OSS/[email protected] › github.com/gin-gonic/[email protected]
• Introduced through: github.com/Contrast-Security-OSS/[email protected] › github.com/gin-contrib/multitemplate@#8a2f6dd269a0 › github.com/gin-gonic/[email protected]

Overview

github.com/gin-gonic/gin is a package that implements a HTTP web framework called gin.

Affected versions of this package are vulnerable to HTTP Response Splitting. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.

Remediation

Upgrade github.com/gin-gonic/gin to version 1.7.7 or higher.

References

• GitHub Issue
• GitHub Release
  
  SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736
  (CVE-2020-28483) github.com/gin-gonic/[email protected]