Read the docs
Red Hat Security Advisory

RHSA-2022:6344

Logging Subsystem 5.5.1 Security and Bug Fix Update

Released 2022-09-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 3 records

TI-2022-13881 CVE-2022-32148 · GHSA-f839-v4x8-wvr3

Exposure of client IP addresses in net/http

Priority LOW 38

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For he…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01517 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4
TI-2022-12767 CVE-2022-30631 · GHSA-r654-8j96-crqx

Stack exhaustion when reading certain archives in compress/gzip

Priority LOW 37

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compres…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02186 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-01571 CVE-2022-1705 · GHSA-5hv8-7f46-fxf6

Improper sanitization of Transfer-Encoding headers in net/http

Priority LOW 32

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to re…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01531 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-444