Failure to strip relative path components in net/url
Priority LOW 37CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 12 fixed, 23 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.
Why it matters now
EPSS 0.02296 83rd percentileScored 2026-11-07
Fix Partial net/url (Go standard library): 1.19.1Red Hat: 12 advisoriesRed Hat: 12 fixed, 23 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/url | 1.19.0-0 to before 1.19.1 | 1.19.1 | Patch available | CNA |
- net/url VendorGo standard library Affected 1.19.0-0 to before 1.19.1 Fixed in 1.19.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:1.19.0:-:*:*:*:*:*:* | 1.19.0 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.19.0:beta1:*:*:*:*:*:* | 1.19.0 beta1 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.19.0:rc1:*:*:*:*:*:* | 1.19.0 rc1 | Vulnerable | Go standard library |
| cpe:2.3:a:golang:go:1.19.0:rc2:*:*:*:*:*:* | 1.19.0 rc2 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:1.19.0:-:*:*:*:*:*:* Versions 1.19.0 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.19.0:beta1:*:*:*:*:*:* Versions 1.19.0 beta1 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.19.0:rc1:*:*:*:*:*:* Versions 1.19.0 rc1 Vulnerable ·Go standard library
- cpe:2.3:a:golang:go:1.19.0:rc2:*:*:*:*:*:* Versions 1.19.0 rc2 Vulnerable ·Go standard library
Remediation
- Fix · CNA net/url (Go standard library) Fixed in 1.19.1
Red Hat 12 advisories
- RHSA-2024:0485 Released 2024-01-31 · Red Hat rating ImportantOpenShift Container Platform 4.12.48 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:3613 Released 2023-06-26 · Red Hat rating ModerateOpenShift Container Platform 4.12.22 packages and security update
- Red Hat OpenShift Container Platform 4.12 bpftool-4.18.0-372.59.1.el8_6, buildah-1:1.23.4-5.1.rhaos4.12.el8, buildah-1:1.23.4-5.rhaos4.12.el9 +47
- RHSA-2023:3742 Released 2023-06-21 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.13.0 security and bug fix update
- RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-rhel9-operator +7
Show 9 more Red Hat advisories
- RHSA-2023:3642 Released 2023-06-15 · Red Hat rating ImportantRed Hat Ceph Storage 6.1 Container security and bug fix update
- Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
- RHSA-2023:0584 Released 2023-05-18 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.1.1 security update
- OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
- RHSA-2023:3205 Released 2023-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2023:3204 Released 2023-05-18 · Red Hat rating ModerateOpenShift Virtualization 4.13.0 RPMs security and bug fix update
- CNV 4.13 for RHEL 7 kubevirt-4.13.0-1469.el7, kubevirt-virtctl-4.13.0-1469.el7, kubevirt-virtctl-redistributable-4.13.0-1469.el7
- CNV 4.13 for RHEL 8 kubevirt-4.13.0-1469.el8, kubevirt-virtctl-4.13.0-1469.el8, kubevirt-virtctl-redistributable-4.13.0-1469.el8
- CNV 4.13 for RHEL 9 kubevirt-4.13.0-1469.el9, kubevirt-virtctl-4.13.0-1469.el9, kubevirt-virtctl-redistributable-4.13.0-1469.el9
- RHSA-2023:0693 Released 2023-02-09 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.7 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-openvpn-rhel8 +8
- RHSA-2023:0264 Released 2023-01-19 · Red Hat rating ModerateRed Hat OpenShift (Logging Subsystem) security update
- RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
- RHSA-2022:7399 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2022:7398 Released 2023-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.12.0 packages and security update
- Ironic content for Red Hat OpenShift Container Platform 4.12 crudini-0.9.3-4.el9, future-0.18.2-9.el9.1, openstack-ironic-1:21.0.1-0.20221114235951.fe64d5e.el9 +47
- Red Hat OpenShift Container Platform 4.12 NetworkManager-1:1.36.0-8.el8_6, NetworkManager-adsl-1:1.36.0-8.el8_6, NetworkManager-bluetooth-1:1.36.0-8.el8_6 +47
- RHSA-2022:8634 Released 2022-11-28 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.1.1 security and bug fix update
- 8Base-OADP-1.1 oadp/oadp-velero-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| Node Maintenance Operator | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Application Interconnect 1.0 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat OpenShift on AWS | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Web Terminal | Affected | No fix yet |
| Self Node Remediation Operator | Affected | No fix yet |
| Service Telemetry Framework 1.4 for RHEL 8 | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.5 | Affected | No fix yet |
| mirror registry for Red Hat OpenShift | Affected | No fix yet |
| 8Base-MTV-2.4 | Fixed | — |
| 8Base-OADP-1.1 | Fixed | RHSA-2022:8634 |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:0693 |
| CNV 4.13 for RHEL 7 | Fixed | RHSA-2023:3204 |
| CNV 4.13 for RHEL 8 | Fixed | RHSA-2023:3204 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2023:3204, RHSA-2023:3205 |
| OSSO 1.1 for RHEL 8 | Fixed | RHSA-2023:0584 |
| Quay v3 | Fixed | — |
| RHODF 4.13 for RHEL 9 | Fixed | RHSA-2023:3742 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2023:0264 |
| Red Hat Ceph Storage 6.1 Tools | Fixed | RHSA-2023:3642 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2022:7398, RHSA-2022:7399, RHSA-2023:3613, RHSA-2024:0485 |
Not affected: 19 products
- 8Base-MTV-2.4
- 8Base-OADP-1.1
- 8Base-RHMTC-1.7
- CNV 4.13 for RHEL 9
- Custom Metric Autoscaler operator for Red Hat Openshift
- Ironic content for Red Hat OpenShift Container Platform 4.12
- OSSO 1.1 for RHEL 8
- OpenShift Service Mesh 2
- RHODF 4.13 for RHEL 9
- RHOL 5.6 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 3
- Red Hat Ceph Storage 6.1 Tools
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenStack Platform 16.2
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2022-32190
- 2026-10-03 Alias added: GHSA-q856-gh5w-3vwg
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-32190 · CVE Program
- CVE-2022-32190 · NVD
- FIRST EPSS
- GHSA-q856-gh5w-3vwg · GitHub Advisory Database · CC BY 4.0
- CVE-2022-32190 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences