1 line
1.8 KiB
JSON
1 line
1.8 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-v84h-653v-4pq9","published":"2024-05-03T17:34:21Z","modified":"2026-02-04T03:34:24.057878Z","aliases":["GO-2024-2812"],"related":["GO-2024-2813"],"summary":"Some CORS middleware allow untrusted origins","details":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.9.0.\n\n### Workarounds\n\nNone.\n","affected":[{"package":{"name":"github.com/jub0bs/fcors","ecosystem":"Go","purl":"pkg:golang/github.com/jub0bs/fcors"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.8.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-v84h-653v-4pq9/GHSA-v84h-653v-4pq9.json"}}],"references":[{"type":"WEB","url":"https://github.com/jub0bs/fcors/security/advisories/GHSA-v84h-653v-4pq9"},{"type":"WEB","url":"https://github.com/jub0bs/fcors/commit/08d85c149a418a583315cee066d4a35cc817219d"},{"type":"WEB","url":"https://github.com/jub0bs/fcors/commit/b5dcb889a49def37d7d9c25deb7135f4eb45625e"},{"type":"PACKAGE","url":"https://github.com/jub0bs/fcors"}],"database_specific":{"cwe_ids":[],"github_reviewed":true,"github_reviewed_at":"2024-05-03T17:34:21Z","nvd_published_at":null,"severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"}]} |