Skip to content
OpenAdvisories
Unscored CVE-2022-32190 BIT-golang-2022-32190EUVD-2022-53402GHSA-q856-gh5w-3vwgGO-2022-0988

Failure to strip relative path components in net/url

Published Sep 13, 2022 · Updated Aug 3, 2024 · Assigned by Go

Vendor: Go standard library Product: net/url Package: go Package: golang-1.19 Package: katib-earlystopping Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: stdlib Ecosystem: Alpine Ecosystem: Debian Ecosystem: Go Ecosystem: Wolfi

Description

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

Affected products

VendorProductAffectedFixed
Go standard library net/url 1.19.0-0 – < 1.19.1 1.19.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 golang-1.19 1.19.1-1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 crudini 0.9.3-4.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 future 0.18.2-9.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic +4 1:21.0.1-0.20221114235951.fe64d5e.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-inspector +3 11.0.1-0.20221205155952.cd22607.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-python-agent 9.0.1-0.20220818145522.ad1eb41.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-macros 2020.1.2-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyOpenSSL +1 20.0.1-2.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyflakes 2.2.0-3.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pysnmp 4.4.12-6.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-SecretStorage 2.3.1-9.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-alembic 1.6.0-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-amqp +1 5.0.6-1.el9 RHSA-2022:7398
Red Hat OpenShift 4 NetworkManager +14 1:1.36.0-8.el8_6 RHSA-2022:7398
Red Hat OpenShift 4 afterburn +1 5.3.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 afterburn-dracut 5.3.0-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner +1 1.4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner-http 1.0.0-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 atomic-openshift-service-idler 4.12.0-202210141624.p0.ga0f9090.assembly.stream.el8 RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 bootupd +1 0.2.5-3.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 buildah +1 1:1.23.4-2.el8 RHSA-2023:3613, RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 butane +1 0.16.0-2.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 conmon 2:2.1.2-2.rhaos4.11.el8 RHSA-2023:3613, RHSA-2022:7398
Red Hat OpenShift 4 conmon-rs 0.4.0-2.rhaos4.12.git.el8 RHSA-2022:7398
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.4-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 container-selinux 2:2.188.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 containernetworking-plugins 1.0.1-5.rhaos4.11.el8 RHSA-2023:3613, RHSA-2022:7398
Red Hat OpenShift 4 containers-common 2:1-27.rhaos4.12.el8 RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 coreos-installer +1 0.16.1-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 coreos-installer-dracut 0.16.1-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 cri-o 1.25.1-5.rhaos4.12.git6005903.el8 RHSA-2022:7398
Red Hat OpenShift 4 cri-tools 1.25.0-2.el8 RHSA-2022:7398
Red Hat OpenShift 4 crit +4 3.15-4.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 crudini 0.9-11.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 crun 1.4.2-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 fuse-overlayfs 1.9-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 grpc +4 1.18.0-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 haproxy +1 2.2.24-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 ignition +1 2.14.0-5.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 kata-containers 2.5.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 kernel-rt +15 4.18.0-372.40.1.rt7.197.el8_6 RHSA-2023:3613, RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 libslirp +1 4.4.0-2.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 nmstate +4 1.3.3-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift +1 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el8 RHSA-2023:3613, RHSA-2022:7398
Red Hat OpenShift 4 openshift-ansible +1 4.12.0-202211071957.p0.g3a9d20e.assembly.stream.el8 RHSA-2023:3613, RHSA-2022:7398
Red Hat OpenShift 4 openshift-clients +1 4.12.0-202301042257.p0.g854f807.assembly.stream.el8 RHSA-2023:3613, RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 openshift-kuryr +4 4.12.0-202210261235.p0.g92b9be2.assembly.stream.el8 RHSA-2023:3613, RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 openshift4-aws-iso 4.12.0-202306090942.p0.gd2acdd5.assembly.stream.el8 RHSA-2023:3613
Red Hat OpenShift 4 openvswitch2.17 +5 2.17.0-62.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ostree +3 2022.2-5.el8 RHSA-2022:7398
Red Hat OpenShift 4 ovn22.06 +3 22.06.0-27.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ovn22.09 +3 22.09.0-25.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ovn22.12 +3 22.12.0-18.el8fdp RHBA-2023:0568
Red Hat OpenShift 4 perf +32 4.18.0-372.43.1.el8_6 RHSA-2023:3613, RHBA-2023:0568
Red Hat OpenShift 4 podman +5 2:4.2.0-1.rhaos4.12.el8 RHSA-2023:3613, RHSA-2022:7398
Red Hat OpenShift 4 podman-gvproxy 3:4.2.0-4.rhaos4.12.el9 RHSA-2023:3613, RHSA-2022:7398
Red Hat OpenShift 4 pycdlib-tools +2 1.11.0-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-alembic +1 1.4.2-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-amqp +2 2.5.2-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-cmd2 +1 1.4.0-1.1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-construct +1 2.10.56-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-dogpile-cache +1 1.1.2-1.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-eventlet +1 0.30.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-flask +2 1:1.1.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-funcsigs +2 1.0.2-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-gunicorn +1 19.9.0-10.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-ifaddr +1 0.1.6-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-importlib-metadata +1 1.7.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-iso8601 +1 0.1.12-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-kombu +1 1:4.6.6-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-kubernetes +2 25.3.0-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-lockfile +1 1:0.11.0-8.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-msgpack +1 0.6.2-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-config +1 2:8.7.1-0.20211012155707.1a7bd66.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-context +2 3.3.1-0.20211012152439.641a1e0.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-db +3 9.1.0-0.20211020204148.be2cc6a.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-i18n +2 5.1.0-0.20211012165753.b031d17.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-log +3 4.6.0-0.20211012154701.41c8807.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-messaging +2 12.9.1-0.20211020204149.f9de265.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-metrics +2 0.3.0-0.20211020174122.43eee50.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-policy +3 3.8.2-0.20211012161944.c7fd9f4.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-serialization +2 4.2.0-0.20211012151454.2b94a4f.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-packaging +2 20.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste +1 3.2.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste-deploy +1 2.0.1-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pexpect +1 4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-pint +1 0.10.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyghmi +1 1.5.14-2.1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyperclip +2 1.6.4-6.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyroute2 +1 0.5.13-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-requests-unixsocket +1 0.1.5-5.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-rsa +1 4.7-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-tenacity +1 6.2.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-wcwidth +1 0.1.7-14.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-werkzeug +1 1.0.1-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zeroconf +1 0.24.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zipp +1 0.5.1-2.el8ost RHSA-2022:7398
Red Hat OpenShift 4 rpm-ostree +2 2022.10.99.g0049dbdd-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 runc 3:1.1.2-2.rhaos4.12.el8 RHSA-2023:3613, RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 skopeo +1 2:1.8.0-1.rhaos4.12.el8 RHSA-2023:3613, RHSA-2022:7398, RHBA-2023:0568
Red Hat OpenShift 4 slirp4netns 1.1.8-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 tini 0.16.1-1.el8ar RHSA-2022:7398
Red Hat OpenShift 4 toolbox 0.1.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat Container Native Virtualization 4 kubevirt +2 4.13.0-1469.el7 RHSA-2023:3204

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 go1.19 1.19.1-150000.1.9.1 SUSE-SU-2022:3326-1
SLES 15 SP3 go1.19 1.19.1-150000.1.9.1 SUSE-SU-2022:3326-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed go1.19 1.19.1-1.1 openSUSE-SU-2024:12310-1
openSUSE Leap 15.4 go1.19 1.19.1-150000.1.9.1 SUSE-SU-2022:3326-1
openSUSE Leap 15.3 go1.19 1.19.1-150000.1.9.1 SUSE-SU-2022:3326-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 go 1.19.1-r0 —
Alpine v3.23 go 1.19.1-r0 —
Alpine v3.22 go 1.19.1-r0 —
Alpine v3.21 go 1.19.1-r0 —
Alpine v3.20 go 1.19.1-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 go 1.19.1-r0 —
Alpine v3.18 go 1.19.1-r0 —
Alpine v3.17 go 1.19.1-r0 —
Alpine v3.16 go 1.18.6-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 golang +7 1.19.3-2.amzn2023.0.2 ALAS2023-2023-048

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 delve 1.8.3-1.0.1.module+el8.7.0+20882+f24d347b ELSA-2023-18908, ELSA-2022-24267
Oracle Linux 8 go-toolset 1.18.8-1.module+el8.7.0+20882+f24d347b ELSA-2023-18908, ELSA-2022-24267
Oracle Linux 8 golang +6 1.18.8-1.0.1.module+el8.7.0+20882+f24d347b ELSA-2023-18908, ELSA-2022-24267

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling katib-earlystopping +8 0.19.0-r31 —
Wolfi rolling katib-suggestion-goptuna-compat 0.19.0-r40 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go stdlib >= 1.19.0-0, < 1.19.1 1.19.1 GO-2022-0988

Advisories 14

References