Skip to content
Fencer Vulns
medium 4.3

CVE-2023-29401 json

Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

published 2023-05-11 3 y ago modified 2026-06-17 4 mo ago also GHSA-2c4m-59x9-fr2g , GO-2023-1737 , EUVD-2023-1445

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat". If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

Patch / fix

  • go github.com/gin-gonic/gin 1.9.1
  • github.com/gin-gonic/gin github.com/gin-gonic/gin 1.9.1
  • golang-github-gin-gonic-gin Debian 14, Debian 13 1.8.1-3

debian advisories DEBIAN-CVE-2023-29401

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29401 updated cvss 4.3

golang-github-gin-gonic-gin: Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function

  • Red Hat Migration Toolkit for Applications 6 mta/mta-admin-addon-rhel8, mta/mta-windup-addon-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/openshift-serverless-1-ingress-rhel8-operator
    affected: no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel7, acm-multicluster-globalhub-agent-container
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-coredns-rhel9
    affected: no fix available
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-ml-pipelines-cache-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Dev Spaces devspaces/machineexec-rhel8
    affected: no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argo-rollouts-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-apiserver-proxy-rhel9
    affected: no fix available
show 6 more
  • Red Hat Quay 3 quay/quay-rhel8, quay/quay-operator-rhel8
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Web Terminal web-terminal-exec-container
    affected: no fix available “Fix deferred”
  • Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-controller-rhel9 2.5.2-5, migration-toolkit-virtualization/mtv-must-gather-api-rhel8 2.5.2-6
    fixed: vendor fix RHBA-2023:6078
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-controller-rhel8 v1.7.11-4
    fixed: vendor fix RHSA-2023:4293
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-api-server-rhel8 v4.14.0-202410151739.p0.gcb552db.assembly.stream.el8, openshift4/ose-image-customization-controller-rhel8 v4.14.0-202310201027.p0.g2dda87a.assembly.stream, openshift4/ose-agent-installer-csr-approver-rhel8 v4.14.0-202410220407.p0.g53ccc48.assembly.stream.el8
    fixed: vendor fix RHSA-2024:8235
  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/lokistack-gateway-rhel8 Red Hat Migration Toolkit for Applications 6 mta/mta-hub-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhel8-operator Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-api-rhel9 2.5.2-5, migration-toolkit-virtualization/mtv-rhel8-operator 2.5.2-3, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 2.5.2-5, migration-toolkit-virtualization/mtv-operator-bundle 2.5.2-20, migration-toolkit-virtualization/mtv-validation-rhel9 2.5.2-5, migration-toolkit-virtualization/mtv-must-gather-rhel8 2.5.2-4, +6 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel8, rhacm2/acm-prometheus-rhel8, rhacm2/multiclusterhub-rhel8, rhacm2/rbac-query-proxy-rhel8, rhacm2/thanos-receive-controller-rhel8
    +5 more products
    Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.11-2, rhmtc/openshift-velero-plugin-rhel8 v1.7.11-3, rhmtc/openshift-migration-velero-rhel8 v1.7.11-3, rhmtc/openshift-migration-openvpn-rhel8 v1.7.11-2, rhmtc/openshift-migration-registry-rhel8 v1.7.11-2, rhmtc/openshift-migration-rhel8-operator v1.7.11-4, +10 more Red Hat OpenShift Container Platform 4 openshift4/ose-grafana, openshift4/ose-thanos-rhel9, openshift4/ose-docker-builder, openshift4/ose-prom-label-proxy, openshift4/ose-prometheus-rhel9, openshift4/ose-prometheus-alertmanager, +4 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202310210434-0, rhcos 414.92.202410112148-0, rhcos 414.92.202410290222-0, openshift4/ose-cli v4.14.0-202310201027.p0.g0c63f9d.assembly.stream, openshift4/ose-pod v4.14.0-202310210404.p0.gf67aeb3.assembly.stream, openshift4/ose-tests v4.14.0-202310201027.p0.g948001a.assembly.stream, +576 more Red Hat OpenShift Container Platform Assisted Installer 1 rhai-tech-preview/assisted-installer-rhel8, rhai-tech-preview/assisted-installer-agent-rhel8 Red Hat OpenStack Platform 18.0 rhoso-operators/rabbitmq-cluster-rhel9-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
22 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/gin-gonic/gin/issues/3555 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
GitHub 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/gin-gonic/gin
>=1.3.1-0.20190301021747-ccb9e902956d, <1.9.1
1.9.1

Affected products

  • github.com/gin-gonic/gin github.com/gin-gonic/gin

Classification

Weakness
  • CWE-494 Download of Code Without Integrity Check

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.