CVE-2017-20146
golang-github-gorilla-handlers: Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of...
CVE-2017-20146 is fixed in golang-github-gorilla-handlers on 1 platform, first by DEBIAN-CVE-2017-20146, released December 27, 2022. It is not reported as exploited. Patch Radar priority: Urgent.
Urgent
CVSS
9.8
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0077
55th percentile
Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| golang-github-gorilla-handlers · Debian 12.15 (bookworm) | 1.3.0-1 | DEBIAN-CVE-2017-20146 | Dec 27, 2022 |
| golang-github-gorilla-handlers · Debian 13.5 (trixie) | 1.3.0-1 | DEBIAN-CVE-2017-20146 | Dec 27, 2022 |
| golang-github-gorilla-handlers · Debian 14 | 1.3.0-1 | DEBIAN-CVE-2017-20146 | Dec 27, 2022 |