Incorrect routing of HTTP requests in gobase when using httpauth
Summary
CVE-2022-2583: gobase subject to Incorrect routing of some HTTP requests when using httpauth due to a race condition. Affects github.com/ntbosscher/gobase versions < 0.7.2. Fixed in 0.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
gobase is a Go package that provides a foundation for building web applications. It offers various functionalities and features to simplify the development process. However, a vulnerability has been identified in gobase when using httpauth, which leads to incorrect routing of some HTTP requests.
Vulnerability Detail
The vulnerability in gobase occurs due to incorrect routing of certain HTTP requests when using httpauth. This can result in unexpected behavior and potential security risks. Attackers may be able to bypass authentication or access unauthorized resources. The issue has been assigned a severity level of HIGH.
How To Fix
Minimum fixed version
0.7.2
This is the first release that contains the fix.
go get github.com/ntbosscher/gobase@v0.7.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of gobase.
Conclusion
In conclusion, the vulnerability in gobase when using httpauth can lead to incorrect routing of HTTP requests. It is recommended to upgrade to version 0.7.2 of gobase to fix this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/ntbosscher/gobase →
FAQ
gobase is a Go package that provides a foundation for building web applications. It offers various functionalities and features to simplify the development process.
The vulnerability in gobase can lead to incorrect routing of some HTTP requests when using httpauth. This can result in unexpected behavior and potential security risks, such as bypassing authentication or accessing unauthorized resources.
To fix this vulnerability, it is recommended to upgrade to version 0.7.2 of gobase. This version includes a patch that addresses the incorrect routing of HTTP requests when using httpauth.
No specific workaround has been mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of gobase.
For more information about this vulnerability, you can email nbosscher@blue-giraffe.ca.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
