PT-2022-17556 · Softwarex · Softwarex

Published 2022-02-11 · Updated 2023-01-05 · CVE-2022-2583

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SoftwareX versions prior to 0.7.2

Description A race condition can cause incorrect HTTP request routing. The issue affects the routing of some HTTP requests when using httpauth.

Recommendations For versions prior to 0.7.2, upgrade to version 0.7.2 to resolve the issue. As a temporary workaround, consider restricting the use of httpauth until the patch is applied.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2022-2583

GHSA-4348-X292-H437

GHSA-H2X7-2FF6-V32P

GO-2022-0400

Affected Products

Softwarex

References · 11

• https://github.com/ntbosscher/gobase/commit/a8d40bce9c429d324122d18c446924dab809e812 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-2583 · Security Note
• https://osv.dev/vulnerability/GO-2022-0400 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4348-x292-h437 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h2x7-2ff6-v32p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2583 · Vendor Advisory
• https://pkg.go.dev/vuln/GO-2022-0400 · Patch
• https://github.com/ntbosscher/gobase/security/advisories/GHSA-h2x7-2ff6-v32p · Note
• https://github.com/ntbosscher/gobase · Note
• https://t.me/cvenotify/40823 · Telegram Post
• https://t.me/cvenotify/41279 · Telegram Post