Summary
It was discovered that the Gin CORS middleware incorrectly handled
wildcards at the end of origin strings. A remote attacker could possibly
use this issue to bypass the configured origin restrictions.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | golang-github-gin-contrib-cors | 1.3.1-1+deb11u1build0.22.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | golang-github-gin-contrib-cors | 1.3.0-2ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | golang-github-gin-contrib-cors | 1.4.0-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Critical 9.1
Gin mishandles a wildcard at the end of an origin string
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.examp…
References
-
report
https://ubuntu.com/security/CVE-2019-25211