github.com/gin-gonic/gin dependency security warning

[serbrech]

1 github.com/gin-gonic/gin vulnerability found in go.sum 3 days ago
Remediation
Upgrade github.com/gin-gonic/gin to version 1.7.0 or later. For example:

require github.com/gin-gonic/gin v1.7.0
Always verify the validity and compatibility of suggestions with your codebase.

Details

CVE-2020-28483
high severity
Vulnerable versions: < 1.7.0
Patched version: 1.7.0
This affects all versions of package github.com/gin-gonic/gin under 1.7.0. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.

go mod why github.com/gin-gonic/gin :

github.com/Azure/azure-service-bus-go
nhooyr.io/websocket
nhooyr.io/websocket.test
github.com/gin-gonic/gin

[serbrech]

coder/websocket#297

[jhendrixMSFT]

Fixed in v0.11.5