CVE-2020-36567 Arbitrary log line injection in github.com/gin-gonic/gin

What is CVE-2020-36567?

CVE-2020-36567 is a high-severity vulnerability in github.com/gin-gonic/gin, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.

Weakness: CWE-116

Which versions are affected by CVE-2020-36567?

3 open source packages ship an affected version, including github.com/gin-gonic/gin. It affects 1 product.

Products include Gin-Gonic Gin.

How do I fix CVE-2020-36567?

Upgrade github.com/gin-gonic/gin to 1.6.0 or later.

Is CVE-2020-36567 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36567 exists.

Other vulnerabilities in github.com/gin-gonic/gin

• CVE-2020-28483 HTTP Response Splitting High 7.1
• CVE-2023-26125 Improper input validation in github.com/gin-gonic/gin Medium 5.6
• CVE-2023-29401 Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-36567, GHSA-6vm3-jj99-7229, GO-2020-0001, UBUNTU-CVE-2020-36567.