x/vulndb: potential Go vuln in github.com/ory/oathkeeper: GHSA-w9mr-28mw-j8hg

[GoVulnBot]

In GitHub Security Advisory GHSA-w9mr-28mw-j8hg, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/ory/oathkeeper	0.40.3	< 0.40.3

Cross references:

• Module github.com/ory/oathkeeper appears in issue x/vulndb: potential Go vuln in github.com/ory/oathkeeper: GHSA-qvp4-rpmr-xwrr #406 EFFECTIVELY_PRIVATE
• Module github.com/ory/oathkeeper appears in issue x/vulndb: potential Go vuln in github.com/ory/oathkeeper: CVE-2021-32701, GHSA-vfvf-6gx5-mqv6 #920 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/ory/oathkeeper
    versions:
      - fixed: 0.40.3
    packages:
      - package: github.com/ory/oathkeeper
summary: Hop-by-hop abuse to malform header mutator
description: |-
    ### Impact

    Downstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config:

    ```yaml
    - id: 'example'
      upstream:
        url: 'https://example.com'
      match:
        url: 'http://127.0.0.1:4455/'
        methods:
          - GET
      authenticators:
        - handler: anonymous
      authorizer:
        handler: allow
      mutators:
        - handler: header
          config:
            headers:
              X-Subject: {{ .Subject }}
    ```

    ```
    curl -H "Connection: x-subject" http://127.0.0.1:4455/
    ```

    The `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.

    ### Patches

    c5cc7f736dc84185034be4356057d1c7a656d797

    ### Workarounds

    The downstream server should handle the case that an expected header is not set by responding with an appropriate error.

    ### References

    See background info in https://github.com/golang/go/issues/50580
ghsas:
  - GHSA-w9mr-28mw-j8hg
references:
  - advisory: https://github.com/ory/oathkeeper/security/advisories/GHSA-w9mr-28mw-j8hg
  - advisory: https://github.com/advisories/GHSA-w9mr-28mw-j8hg

[zpavlinovic]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/490635 mentions this issue: data/excluded: batch add GO-2023-1748, GO-2023-1747, GO-2023-1749

[gopherbot]

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606785 mentions this issue: data/reports: unexclude 20 reports (5)