Authorization Bypass Through User-Controlled Key in emicklei/go-restful
Published Jun 6, 2022
9.1
CRITICALCVSS 3.1
EPSS 3.12%
Description
Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
Affected products
-
- Version unspecifiedStatusaffectedConstraints<v3.8.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Emicklei | Emicklei/go-Restful | n/a |
|
Configuration 1
- < 2.16.0
- ≥ 3.0.0 · < 3.8.0
Configuration 2
- 35
- 36
No data.
Cryostat 2 on RHEL 8
cryostat-tech-preview/cryostat-grafana-dashboard-rhel8:2.2.0-14
Fixed · RHSA-2023:0814
Cryostat 2 on RHEL 8
cryostat-tech-preview/cryostat-operator-bundle:2.2.1-8
Fixed · RHSA-2023:0814
Cryostat 2 on RHEL 8
cryostat-tech-preview/cryostat-reports-rhel8:1.1.1-9
Fixed · RHSA-2023:0814
Cryostat 2 on RHEL 8
cryostat-tech-preview/cryostat-rhel8-operator:2.2.1-11
Fixed · RHSA-2023:0814
Cryostat 2 on RHEL 8
cryostat-tech-preview/cryostat-rhel8:2.2.1-8
Fixed · RHSA-2023:0814
Cryostat 2 on RHEL 8
cryostat-tech-preview/jfr-datasource-rhel8:2.2.0-14
Fixed · RHSA-2023:0814
Openshift Serveless 1.24
openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1-tech-preview/eventing-kafka-broker-webhook-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/client-kn-rhel8:1.3.1-4
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-controller-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.3.2-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-mtping-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-storage-version-migration-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-sugar-controller-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/eventing-webhook-rhel8:1.3.2-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/ingress-rhel8-operator:1.24.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/kn-cli-artifacts-rhel8:1.3.1-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/knative-rhel8-operator:1.24.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/kourier-control-rhel8:1.3.0-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/net-istio-controller-rhel8:1.3.0-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/net-istio-webhook-rhel8:1.3.0-2
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serverless-operator-bundle:1.24.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serverless-rhel8-operator:1.24.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-activator-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-autoscaler-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-controller-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-domain-mapping-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-queue-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-storage-version-migration-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/serving-webhook-rhel8:1.3.0-3
Fixed · RHSA-2022:6040
Openshift Serveless 1.24
openshift-serverless-1/svls-must-gather-rhel8:1.24.0-2
Fixed · RHSA-2022:6040
Openshift Serverless 1 on RHEL 8
openshift-serverless-clients-0:1.3.1-4.el8
Fixed · RHSA-2022:6042
RHEL-8-CNV-4.9
container-native-virtualization/cluster-network-addons-operator:v4.9.7-4
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/hostpath-provisioner-rhel8-operator:v4.9.7-4
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/hostpath-provisioner-rhel8:v4.9.7-3
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/hyperconverged-cluster-webhook-rhel8:v4.9.7-4
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/kubemacpool:v4.9.7-4
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/kubevirt-ssp-operator:v4.9.7-4
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/kubevirt-vmware:v4.9.7-2
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/libguestfs-tools:v4.9.7-5
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/node-maintenance-operator:v4.9.7-4
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/virt-cdi-cloner:v4.9.7-3
Fixed · RHSA-2022:8609
RHEL-8-CNV-4.9
container-native-virtualization/vm-import-virtv2v-rhel8:v4.9.7-4
Fixed · RHSA-2022:8609
Red Hat OpenShift GitOps 1.8
openshift-gitops-kam-0:1.8.3-6.el8
Fixed · RHSA-2023:3229
Red Hat OpenShift GitOps 1.9
openshift-gitops-kam-0:1.9.0-102.el8
Fixed · RHSA-2023:3557
OpenShift Developer Tools and Services
helm
Affected
OpenShift Developer Tools and Services
odo
Will not fix
OpenShift Pipelines
openshift-pipelines-client
Not affected
OpenShift Serverless
cli
Affected
OpenShift Serverless
knative-eventing
Affected
OpenShift Service Mesh 2.0
servicemesh
Not affected
OpenShift Service Mesh 2.1
servicemesh
Not affected
OpenShift Service Mesh 2.1
servicemesh-prometheus
Not affected
Red Hat 3scale API Management Platform 2
3scale-rhel7-operator
Affected
Red Hat Ansible Automation Platform 1.2
openshift-clients
Will not fix
Red Hat Ansible Automation Platform 2
openshift-clients
Will not fix
Red Hat OpenShift Container Platform 3.11
ansible-service-broker
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-enterprise-service-catalog
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift-descheduler
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift-dockerregistry
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift-service-idler
Will not fix
Red Hat OpenShift Container Platform 3.11
atomic-openshift-web-console
Not affected
Red Hat OpenShift Container Platform 3.11
golang-github-openshift-oauth-proxy
Will not fix
Red Hat OpenShift Container Platform 3.11
openshift-enterprise-cluster-capacity
Not affected
Red Hat OpenShift Container Platform 3.11
podman
Not affected
Red Hat OpenShift Container Platform 4
atomic-enterprise-service-catalog
Will not fix
Red Hat OpenShift Container Platform 4
atomic-openshift-service-idler
Will not fix
Red Hat OpenShift Container Platform 4
cri-o
Not affected
Red Hat OpenShift Container Platform 4
machine-config-daemon
Will not fix
Red Hat OpenShift Container Platform 4
openshift
Will not fix
Red Hat OpenShift Container Platform 4
openshift-clients
Will not fix
Red Hat OpenShift Virtualization 4
kubevirt
Affected
Red Hat Openshift Container Storage 4
mcg
Will not fix
Red Hat Openshift Data Foundation 4
mcg
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Cryostat 2 on RHEL 8 | cryostat-tech-preview/cryostat-grafana-dashboard-rhel8:2.2.0-14 | Fixed | RHSA-2023:0814 |
| Cryostat 2 on RHEL 8 | cryostat-tech-preview/cryostat-operator-bundle:2.2.1-8 | Fixed | RHSA-2023:0814 |
| Cryostat 2 on RHEL 8 | cryostat-tech-preview/cryostat-reports-rhel8:1.1.1-9 | Fixed | RHSA-2023:0814 |
| Cryostat 2 on RHEL 8 | cryostat-tech-preview/cryostat-rhel8-operator:2.2.1-11 | Fixed | RHSA-2023:0814 |
| Cryostat 2 on RHEL 8 | cryostat-tech-preview/cryostat-rhel8:2.2.1-8 | Fixed | RHSA-2023:0814 |
| Cryostat 2 on RHEL 8 | cryostat-tech-preview/jfr-datasource-rhel8:2.2.0-14 | Fixed | RHSA-2023:0814 |
| Openshift Serveless 1.24 | openshift-serverless-1-tech-preview/eventing-kafka-broker-controller-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1-tech-preview/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1-tech-preview/eventing-kafka-broker-receiver-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1-tech-preview/eventing-kafka-broker-webhook-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/client-kn-rhel8:1.3.1-4 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-controller-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.3.2-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-mtping-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-storage-version-migration-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-sugar-controller-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/eventing-webhook-rhel8:1.3.2-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/ingress-rhel8-operator:1.24.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/kn-cli-artifacts-rhel8:1.3.1-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/knative-rhel8-operator:1.24.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/kourier-control-rhel8:1.3.0-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/net-istio-controller-rhel8:1.3.0-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/net-istio-webhook-rhel8:1.3.0-2 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serverless-operator-bundle:1.24.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serverless-rhel8-operator:1.24.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-activator-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-autoscaler-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-controller-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-domain-mapping-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-queue-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-storage-version-migration-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/serving-webhook-rhel8:1.3.0-3 | Fixed | RHSA-2022:6040 |
| Openshift Serveless 1.24 | openshift-serverless-1/svls-must-gather-rhel8:1.24.0-2 | Fixed | RHSA-2022:6040 |
| Openshift Serverless 1 on RHEL 8 | openshift-serverless-clients-0:1.3.1-4.el8 | Fixed | RHSA-2022:6042 |
| RHEL-8-CNV-4.9 | container-native-virtualization/cluster-network-addons-operator:v4.9.7-4 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/hostpath-provisioner-rhel8-operator:v4.9.7-4 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/hostpath-provisioner-rhel8:v4.9.7-3 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/hyperconverged-cluster-webhook-rhel8:v4.9.7-4 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/kubemacpool:v4.9.7-4 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/kubevirt-ssp-operator:v4.9.7-4 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/kubevirt-vmware:v4.9.7-2 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/libguestfs-tools:v4.9.7-5 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/node-maintenance-operator:v4.9.7-4 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/virt-cdi-cloner:v4.9.7-3 | Fixed | RHSA-2022:8609 |
| RHEL-8-CNV-4.9 | container-native-virtualization/vm-import-virtv2v-rhel8:v4.9.7-4 | Fixed | RHSA-2022:8609 |
| Red Hat OpenShift GitOps 1.8 | openshift-gitops-kam-0:1.8.3-6.el8 | Fixed | RHSA-2023:3229 |
| Red Hat OpenShift GitOps 1.9 | openshift-gitops-kam-0:1.9.0-102.el8 | Fixed | RHSA-2023:3557 |
| OpenShift Developer Tools and Services | helm | Affected | n/a |
| OpenShift Developer Tools and Services | odo | Will not fix | n/a |
| OpenShift Pipelines | openshift-pipelines-client | Not affected | n/a |
| OpenShift Serverless | cli | Affected | n/a |
| OpenShift Serverless | knative-eventing | Affected | n/a |
| OpenShift Service Mesh 2.0 | servicemesh | Not affected | n/a |
| OpenShift Service Mesh 2.1 | servicemesh | Not affected | n/a |
| OpenShift Service Mesh 2.1 | servicemesh-prometheus | Not affected | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-rhel7-operator | Affected | n/a |
| Red Hat Ansible Automation Platform 1.2 | openshift-clients | Will not fix | n/a |
| Red Hat Ansible Automation Platform 2 | openshift-clients | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | ansible-service-broker | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-enterprise-service-catalog | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-descheduler | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-dockerregistry | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-service-idler | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-web-console | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | golang-github-openshift-oauth-proxy | Will not fix | n/a |
| Red Hat OpenShift Container Platform 3.11 | openshift-enterprise-cluster-capacity | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | podman | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | atomic-enterprise-service-catalog | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | atomic-openshift-service-idler | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | cri-o | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | machine-config-daemon | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-clients | Will not fix | n/a |
| Red Hat OpenShift Virtualization 4 | kubevirt | Affected | n/a |
| Red Hat Openshift Container Storage 4 | mcg | Will not fix | n/a |
| Red Hat Openshift Data Foundation 4 | mcg | Will not fix | n/a |
github.com/emicklei/go-restful/v3
Go
Introduced 3.0.0 Fixed 3.8.0github.com/emicklei/go-restful/v2
Go
Introduced 2.7.1 Fixed not fixedgithub.com/emicklei/go-restful
Go
Introduced 0 Fixed 2.16.0+incompatible
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/emicklei/go-restful/v3 | 3.0.0 | 3.8.0 |
| Go | github.com/emicklei/go-restful/v2 | 2.7.1 | not fixed |
| Go | github.com/emicklei/go-restful | 0 | 2.16.0+incompatible |
Remediation
Red Hat statement
The go-restful package is a transitive dependency which is being pulled with k8s.io/api and not directly being used anywhere in OpenShift Container Platform (OCP), OpenShift Container Storage, OpenShift Data Foundation, OpenShift Do and OpenShift Pipelines, hence these components are marked as 'Will not fix' or even "Not affected".
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
AV:N/AC:L/Au:N/C:P/I:P/A:N
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (23 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 3.12% (0.03115) | 87.36th | v5 (v2026.06.15) |
| Jun 15, 2026 | 2.76% (0.02760) | 84.30th | v5 (v2026.06.15) |
| Nov 21, 2025 | 0.91% (0.00914) | 75.17th | v4 (v2025.03.14) |
| Nov 18, 2025 | 2.42% (0.02418) | 83.79th | v4 (v2025.03.14) |
| Mar 30, 2025 | 0.64% (0.00642) | 68.17th | v4 (v2025.03.14) |
| Mar 29, 2025 | 1.82% (0.01824) | 71.75th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.64% (0.00642) | 68.85th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.31% (0.00308) | 70.81th | v3 (v2023.03.01) |
| Dec 28, 2023 | 0.24% (0.00238) | 61.86th | v3 (v2023.03.01) |
| Nov 17, 2023 | 0.24% (0.00245) | 62.33th | v3 (v2023.03.01) |
| Nov 8, 2023 | 0.21% (0.00208) | 58.50th | v3 (v2023.03.01) |
| Sep 11, 2023 | 0.35% (0.00347) | 68.17th | v3 (v2023.03.01) |
| Jul 9, 2023 | 0.31% (0.00312) | 66.00th | v3 (v2023.03.01) |
| Jul 8, 2023 | 0.26% (0.00260) | 62.59th | v3 (v2023.03.01) |
| Jun 13, 2023 | 0.34% (0.00342) | 67.35th | v3 (v2023.03.01) |
| May 7, 2023 | 0.23% (0.00228) | 59.50th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.21% (0.00208) | 56.96th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.54% (0.01537) | 74.52th | v2 (v2022.01.01) |
| Feb 23, 2023 | 1.54% (0.01537) | 74.48th | v2 (v2022.01.01) |
| Sep 24, 2022 | 1.18% (0.01183) | 60.62th | v2 (v2022.01.01) |
| Jul 13, 2022 | 1.11% (0.01108) | 52.73th | v2 (v2022.01.01) |
| Jun 23, 2022 | 1.02% (0.01018) | 37.89th | v2 (v2022.01.01) |
| Jun 7, 2022 | 0.89% (0.00885) | 25.05th | v2 (v2022.01.01) |
References (28)
- https://access.redhat.com/security/cve/CVE-2022-1996 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2094982 Issue Tracking
- https://github.com/advisories/GHSA-r48q-9g5r-8q2h Advisory
- https://github.com/emicklei/go-restful/commit/926662532deb450272956c7bc573978464aae74e
- https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1
- https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10 PatchThird Party Advisory
- https://github.com/emicklei/go-restful/issues/489
- https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1 ExploitPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1996
- https://pkg.go.dev/vuln/GO-2022-0619
- https://security.netapp.com/advisory/ntap-20220923-0005/ Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-1996
Change history (0)
No recorded changes yet.