-
Notifications
You must be signed in to change notification settings - Fork 58
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x/vulndb: potential Go vuln in github.com/gophish/gophish: CVE-2022-25295 #987
Labels
excluded: NOT_IMPORTABLE
This vulnerability only exists in a binary and is not importable.
NeedsTriage
Comments
Binary, has not been imported by any other module. The package where the fix is made is imported in the sense that the whole repo is forked. |
zpavlinovic
added
the
excluded: NOT_IMPORTABLE
This vulnerability only exists in a binary and is not importable.
label
Sep 16, 2022
Change https://go.dev/cl/431536 mentions this issue: |
gopherbot
pushed a commit
that referenced
this issue
Sep 19, 2022
Fixes #987 Change-Id: I5e05b6b581b0c4739fddac50605895a3b0bc5761 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/431536 Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com> Auto-Submit: Zvonimir Pavlinovic <zpavlinovic@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Damien Neil <dneil@google.com>
This was referenced Mar 22, 2023
Change https://go.dev/cl/592774 mentions this issue: |
Change https://go.dev/cl/607230 mentions this issue: |
gopherbot
pushed a commit
that referenced
this issue
Aug 21, 2024
- data/reports/GO-2022-0985.yaml - data/reports/GO-2022-0986.yaml - data/reports/GO-2022-0987.yaml - data/reports/GO-2022-0989.yaml - data/reports/GO-2022-0995.yaml - data/reports/GO-2022-1000.yaml - data/reports/GO-2022-1006.yaml - data/reports/GO-2022-1014.yaml - data/reports/GO-2022-1015.yaml - data/reports/GO-2022-1019.yaml - data/reports/GO-2022-1021.yaml - data/reports/GO-2022-1023.yaml - data/reports/GO-2022-1029.yaml - data/reports/GO-2022-1032.yaml - data/reports/GO-2022-1033.yaml - data/reports/GO-2022-1060.yaml - data/reports/GO-2022-1062.yaml - data/reports/GO-2022-1065.yaml - data/reports/GO-2022-1066.yaml - data/reports/GO-2022-1067.yaml Updates #985 Updates #986 Updates #987 Updates #989 Updates #995 Updates #1000 Updates #1006 Updates #1014 Updates #1015 Updates #1019 Updates #1021 Updates #1023 Updates #1029 Updates #1032 Updates #1033 Updates #1060 Updates #1062 Updates #1065 Updates #1066 Updates #1067 Change-Id: I27b6f79e1898a13040a758a71348464c5e7c72a9 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607230 Auto-Submit: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Commit-Queue: Tatiana Bradley <tatianabradley@google.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
excluded: NOT_IMPORTABLE
This vulnerability only exists in a binary and is not importable.
NeedsTriage
CVE-2022-25295 references github.com/gophish/gophish, which may be a Go module.
Description:
This affects the package github.com/gophish/gophish before 0.12.0.
The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\example.com, browser will redirect user to http://example.com.
References:
See doc/triage.md for instructions on how to triage this report.
The text was updated successfully, but these errors were encountered: