CVE-2022-30636 — X Crypto Golang.org X Crypto Acme Autocert vulnerability

5 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 59.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Golang.org X Crypto Golang.org X Crypto Acme AutocertGolang.org X Crypto
Timeline
PublishedJul 2

Description

httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to lookup in the DirCache implementation. On Windows, path.Base acts differently to filepath.Base, since Windows uses a different path separator (\ vs. /), allowing a user to provide a relative path, i.e. .well-known/acme-challenge/..\..\asd becomes ..\..\asd. The extracted path is then suffixed with +http-01, joined with the cache directory, and opened. Since the controlled path is suffixed with +http-01 before opening…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5golang.org/x_crypto_golang.org_x_crypto_acme_autocert< 0.0.0-20220525230936-793ad666bf5e
▶Gogolang.org/x_crypto< 0.0.0-20220525230936-793ad666bf5e

🔴Vulnerability Details

3
OSV
Limited directory traversal vulnerability on Windows in golang.org/x/crypto↗2024-07-02
▶
OSV
CVE-2022-30636: httpTokenCacheKey uses path↗2024-07-02
▶
CVEList
Limited directory traversal vulnerability on Windows in golang.org/x/crypto↗2024-07-02
▶

📋Vendor Advisories

1
Debian
CVE-2022-30636: golang-go.crypto - httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token value to ...↗2022
▶
CVE-2022-30636 — HIGH severity | cvebase