Vulnerability Description
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | 1.19.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/423514PatchRelease Notes
- https://go.dev/issue/54385Issue TrackingPatchVendor Advisory
- https://groups.google.com/g/golang-announce/c/x49AQzIVX-sMailing ListThird Party Advisory
- https://pkg.go.dev/vuln/GO-2022-0988Issue TrackingPatchVendor Advisory
- https://go.dev/cl/423514PatchRelease Notes
- https://go.dev/issue/54385Issue TrackingPatchVendor Advisory
- https://groups.google.com/g/golang-announce/c/x49AQzIVX-sMailing ListThird Party Advisory
- https://pkg.go.dev/vuln/GO-2022-0988Issue TrackingPatchVendor Advisory
FAQ
What is CVE-2022-32190?
CVE-2022-32190 is a vulnerability with a CVSS score of 7.5 (HIGH). JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath doc...
How severe is CVE-2022-32190?
CVE-2022-32190 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-32190?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Go.