Input validation error in Gin - CVE-2023-26125

Vulnerability identifier: #VU84618

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26125

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to poison application's cache.

The vulnerability exists due to insufficient validation of user-supplied input when processing X-Forwarded-Prefix header. A remote attacker can pass send specially crafted request to the application and perform cache poisoning.

Gin
Astronomer with IBM
IBM Cloud Pak for Watson AIOps
Migration Toolkit for Virtualization
Splunk Enterprise
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Planning Analytics Local

Install updates from vendor's website.

Gin - update to 1.9.0
Astronomer with IBM - update to 1.0.1
Migration Toolkit for Virtualization - update to 2.5.2
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
Migration Toolkit for Containers - update to 1.7.11
Planning Analytics Local - addressed in versions 2.0.0.96, 2.1.3
IBM Cloud Pak for Watson AIOps - update to 4.1.1
Red Hat OpenShift Container Platform - addressed in versions 4.13.53, 4.13.54

• https://github.com/t0rchwo0d/gin/commit/fd9f98e70fb4107ee68c783482d231d35e60507b
• https://github.com/gin-gonic/gin/pull/3500
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285
• https://github.com/gin-gonic/gin/pull/3503
• https://github.com/gin-gonic/gin/releases/tag/v1.9.0

• Cache poisoning attack in Gin-Gonic Gin
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.5
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Migration Toolkit for Containers 1.7
• Multiple vulnerabilities in Astronomer with IBM