Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs #71984

Open
neild opened this issue Feb 26, 2025 · 5 comments
Open

net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs #71984

neild opened this issue Feb 26, 2025 · 5 comments
Labels
NeedsFix The path to resolution is known, but the work has not been done. Security vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Milestone
Go1.25

Comments

@neild
Copy link
Contributor

neild commented Feb 26, 2025 •
edited by JunyangShao
Loading

Matching of hosts against proxy patterns could improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable was set to "*.example.com", a request to "[::1%25.example.com]:80` would incorrectly match and not be proxied.

Thanks to Juho Forsén of Mattermost for reporting this issue.

This is CVE-2025-22870

/cc @golang/security and @golang/release
@neild
Copy link
Contributor Author

neild commented Feb 26, 2025

@gopherbot please open backport issues for this security fix

@gopherbot
Copy link
Contributor

Backport issue(s) opened: #71985 (for 1.23), #71986 (for 1.24).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

This was referenced Feb 26, 2025
Closed
Closed
@gabyhelp gabyhelp added the vulncheck or vulndb Issues for the x/vuln or x/vulndb repo label Feb 26, 2025
@dmitshur dmitshur added Security NeedsFix The path to resolution is known, but the work has not been done. labels Feb 27, 2025
@dmitshur dmitshur added this to the Go1.25 milestone Feb 27, 2025
@JunyangShao JunyangShao changed the title security: fix CVE-2025-22870 net/http, x/net/proxy, x/net/http/httpproxy: proxy bypass using IPv6 zone IDs Mar 4, 2025
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/654717 mentions this issue: all: update golang.org/x/net

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/654795 mentions this issue: [release-branch.go1.24] all: updates vendored x/net

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/654796 mentions this issue: [release-branch.go1.23] all: updates vendored x/net

gopherbot pushed a commit that referenced this issue Mar 4, 2025
@JunyangShao @gopherbot
[release-branch.go1.24] all: updates vendored x/net
e4119e9 
This is to update module version to the fixed x/net.

For #71984

Change-Id: I7d50e302e8ba7d3ee28df2669fc16f19c12cf088
Reviewed-on: https://go-review.googlesource.com/c/go/+/654795
Reviewed-by: Michael Pratt <[email protected]>
Auto-Submit: Junyang Shao <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Junyang Shao <[email protected]>
gopherbot pushed a commit that referenced this issue Mar 4, 2025
@JunyangShao @gopherbot
[release-branch.go1.23] all: updates vendored x/net
45aade7 
This is to update module version to the fixed x/net.

For #71984

Change-Id: I8f4357f14a7d44a782c131eb856b50a103be2f2d
Reviewed-on: https://go-review.googlesource.com/c/go/+/654796
Reviewed-by: Junyang Shao <[email protected]>
Auto-Submit: Junyang Shao <[email protected]>
Reviewed-by: Michael Pratt <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
gopherbot pushed a commit that referenced this issue Mar 4, 2025
@JunyangShao @gopherbot
all: update golang.org/x/net
3705a6f 
For #71984

Change-Id: Ic15826f09ea818f8833bd3d979bffaede24d49df
Reviewed-on: https://go-review.googlesource.com/c/go/+/654717
Reviewed-by: Michael Pratt <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Junyang Shao <[email protected]>
mnencia added a commit to cloudnative-pg/plugin-barman-cloud that referenced this issue Mar 5, 2025
@mnencia
fix(deps): update golang.org/x/net
e944b6a 
see golang/go#71984

Signed-off-by: Marco Nenciarini <[email protected]>
@mnencia mnencia mentioned this issue Mar 5, 2025
Merged
mnencia added a commit to cloudnative-pg/plugin-barman-cloud that referenced this issue Mar 5, 2025
@mnencia
fix(deps): update golang.org/x/net
f0a96e4 
See golang/go#71984

Signed-off-by: Marco Nenciarini <[email protected]>
fcanovai pushed a commit to cloudnative-pg/plugin-barman-cloud that referenced this issue Mar 5, 2025
@mnencia
fix(deps): update golang.org/x/net (#188)
aba0748 
See golang/go#71984

Signed-off-by: Marco Nenciarini <[email protected]>
This was referenced Mar 5, 2025
Merged
Merged
Merged
Merged
@bewebi bewebi mentioned this issue Mar 5, 2025
Merged
4 tasks
@macabu macabu mentioned this issue Mar 5, 2025
Merged
3 tasks
@bewebi bewebi mentioned this issue Mar 5, 2025
Merged
4 tasks
@nicholasngai nicholasngai mentioned this issue Mar 6, 2025
Open
@alexandrevicenzi alexandrevicenzi mentioned this issue Mar 6, 2025
Open
This was referenced Mar 6, 2025
Merged
Merged
dcermak pushed a commit to SUSE/skopeo that referenced this issue Mar 6, 2025
@neild @dcermak
proxy, http/httpproxy: do not mismatch IPv6 zone ids against hosts
c425898 
When matching against a host "example.com",
don't match an IPv6 address like "[1000::1%25.example.com]:80".

Thanks to Juho Forsén of Mattermost for reporting this issue.

Fixes CVE-2025-22870
For golang/go#71984
Fixes [bsc#1238685](https://bugzilla.suse.com/show_bug.cgi?id=1238685)
@dcermak dcermak mentioned this issue Mar 6, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
NeedsFix The path to resolution is known, but the work has not been done. Security vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Projects
None yet
Milestone
Go1.25
Development

No branches or pull requests
4 participants
@neild @dmitshur @gopherbot @gabyhelp