{"id":"GO-2024-2955","summary":"Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors","details":"Gin-Gonic CORS middleware mishandles a wildcard at the end of an origin string. Examples: https://example.community/* is accepted by the origin string https://example.com/* and http://localhost.example.com/* is accepted by the origin string http://localhost/* .","aliases":["CVE-2019-25211","GHSA-869c-j7wc-8jqv"],"modified":"2024-07-02T19:57:15.180688Z","published":"2024-07-02T19:23:53Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2024-2955"},"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-869c-j7wc-8jqv"},{"type":"FIX","url":"https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d"},{"type":"FIX","url":"https://github.com/gin-contrib/cors/pull/106"},{"type":"FIX","url":"https://github.com/gin-contrib/cors/pull/57"},{"type":"WEB","url":"https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0"},{"type":"WEB","url":"https://github.com/gin-contrib/cors/releases/tag/v1.6.0"}],"affected":[{"package":{"name":"github.com/gin-contrib/cors","ecosystem":"Go","purl":"pkg:golang/github.com/gin-contrib/cors"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/gin-contrib/cors","symbols":["Config.parseWildcardRules","Default","New"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2024-2955.json"}}],"schema_version":"1.7.3","credits":[{"name":"@maxshine"}]}