CVE-2022-21221: Path traversal in github.com/valyala/fasthttp
(updated )
The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only.
References
- github.com/advisories/GHSA-fx95-883v-4q4h
- github.com/valyala/fasthttp/commit/15262ecf3c602364639d465daba1e7f3604d00e8
- github.com/valyala/fasthttp/commit/6b5bc7bb304975147b4af68df54ac214ed2554c1
- github.com/valyala/fasthttp/issues/1226
- github.com/valyala/fasthttp/releases/tag/v1.34.0
- nvd.nist.gov/vuln/detail/CVE-2022-21221
- snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVALYALAFASTHTTP-2407866
Code Behaviors & Features
Detect and mitigate CVE-2022-21221 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →