github.com/gin-contrib/cors: Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors
Published Jun 28, 2024
9.3
CRITICALCVSS 4.0
EPSS 0.43%
Description
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.
Affected products
No data.
No data.
-
- Version 0StatusaffectedConstraints<1.6.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gin-Contrib | Cors | n/a |
|
Red Hat Migration Toolkit for Containers 1.8
rhmtc/openshift-migration-controller-rhel8:v1.8.4-22
Fixed · RHSA-2024:7164
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-api-rhel9
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-controller-rhel9
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-openstack-populator-rhel9
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-ova-provider-server-rhel9
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-populator-controller-rhel9
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-rhel8-operator
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-rhv-populator-rhel8
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-validation-rhel9
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-virt-v2v-rhel9
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-virt-v2v-warm-rhel8
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Migration Toolkit for Containers 1.8 | rhmtc/openshift-migration-controller-rhel8:v1.8.4-22 | Fixed | RHSA-2024:7164 |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-api-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-controller-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-openstack-populator-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-ova-provider-server-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-populator-controller-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-rhel8-operator | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-rhv-populator-rhel8 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-validation-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-virt-v2v-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-virt-v2v-warm-rhel8 | Fix deferred | n/a |
github.com/gin-contrib/cors
Go
Introduced 0 Fixed 1.6.0github.com/gin-gonic/gin
Go
Introduced 0 Fixed 1.6.0
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/gin-contrib/cors | 0 | 1.6.0 |
| Go | github.com/gin-gonic/gin | 0 | 1.6.0 |
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (11)
- https://access.redhat.com/security/cve/CVE-2019-25211 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2295302 Issue Tracking
- https://github.com/advisories/GHSA-869c-j7wc-8jqv Advisory
- https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d
- https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0
- https://github.com/gin-contrib/cors/pull/106
- https://github.com/gin-contrib/cors/pull/57
- https://github.com/gin-contrib/cors/releases/tag/v1.6.0
- https://lists.debian.org/debian-lts-announce/2025/08/msg00024.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-25211
- https://www.cve.org/CVERecord?id=CVE-2019-25211
Change history (0)
No recorded changes yet.