CVE-2019-25211

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-25211
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-25211.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-25211
Aliases
Related
Published
2024-06-29T00:15:02Z
Modified
2024-10-12T04:58:34.305273Z
Summary
[none]
Details

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.

References

Affected packages

Debian:11 / golang-github-gin-contrib-cors

Package

Name
golang-github-gin-contrib-cors
Purl
pkg:deb/debian/golang-github-gin-contrib-cors?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.1-1
1.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / golang-github-gin-contrib-cors

Package

Name
golang-github-gin-contrib-cors
Purl
pkg:deb/debian/golang-github-gin-contrib-cors?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / golang-github-gin-contrib-cors

Package

Name
golang-github-gin-contrib-cors
Purl
pkg:deb/debian/golang-github-gin-contrib-cors?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/gin-contrib/cors

Affected ranges

Type
GIT
Repo
https://github.com/gin-contrib/cors
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
27b723a473efd80d5a498fa9f5933c80204c850d

Affected versions

v1.*

v1.0
v1.1
v1.2
v1.3.0
v1.3.1
v1.4.0
v1.5.0