github.com/emicklei/go-restful: CVE-2022-1996

[github-actions]

Title

go-restful: Authorization Bypass Through User-Controlled Key

Description

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Severity

CRITICAL

Primary URL

https://avd.aquasec.com/nvd/cve-2022-1996

References

• https://access.redhat.com/security/cve/CVE-2022-1996
• GHSA-r48q-9g5r-8q2h
• emicklei/go-restful@fd3c327
• [security] Authorization Bypass Through User-Controlled Key emicklei/go-restful#489
• https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
• https://nvd.nist.gov/vuln/detail/CVE-2022-1996

[afdesk]

just for information:

$ go mod why github.com/emicklei/go-restful
# github.com/emicklei/go-restful
github.com/aquasecurity/trivy/pkg/k8s/commands
github.com/aquasecurity/trivy-kubernetes/pkg/k8s
k8s.io/cli-runtime/pkg/genericclioptions
k8s.io/client-go/discovery
k8s.io/client-go/openapi
k8s.io/kube-openapi/pkg/handler3
k8s.io/kube-openapi/pkg/common
github.com/emicklei/go-restful

[knqyf263]

@DmitriyLewen Could you look into it?

[jadechip]

Has this been fixed in version 0.30.0?

[knqyf263]

We're waiting for this PR.
aquasecurity/trivy-kubernetes#57