CVE-2022-32190 Failure to strip relative path components in net/url

2022-09-1317:08:57

www.cve.org

cve-2022-32190

failure to strip

relative path components

net/url joinpath

7.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.3%

JSON

JoinPath and URL.JoinPath do not remove …/ path elements appended to a relative path. For example, JoinPath(“https://go.dev”, “…/go”) returns the URL “https://go.dev/../go”, despite the JoinPath documentation stating that …/ path elements are removed from the result.

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "net/url",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "net/url",
    "versions": [
      {
        "version": "1.19.0-0",
        "lessThan": "1.19.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "URL.JoinPath"
      },
      {
        "name": "JoinPath"
      }
    ],
    "defaultStatus": "unaffected"
  }
]