github.com/goFiber/fiber/v2-v2.1.4: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

[mend-for-github-com[bot]]

Vulnerable Library - github.com/goFiber/fiber/v2-v2.1.4

Found in HEAD commit: 29d8b651f4cf8d4395286c0ea48f5fcfb0d8ed33

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (github.com/goFiber/fiber/v2-v2.1.4 version)	Remediation Available
CVE-2022-21221	High	7.5	github.com/valyala/fasthtTp-v1.17.0	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-21221

### Vulnerable Library - github.com/valyala/fasthtTp-v1.17.0

Fast HTTP package for Go. Tuned for high performance. Zero memory allocations in hot paths. Up to 10x faster than net/http

Library home page: https://proxy.golang.org/github.com/valyala/fasthttp/@v/v1.17.0.zip

Dependency Hierarchy: - github.com/goFiber/fiber/v2-v2.1.4 (Root Library) - :x: **github.com/valyala/fasthtTp-v1.17.0** (Vulnerable Library)

Found in HEAD commit: 29d8b651f4cf8d4395286c0ea48f5fcfb0d8ed33

Found in base branch: main

### Vulnerability Details

The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.

Publish Date: 2022-03-17

URL: CVE-2022-21221

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21221

Release Date: 2022-03-17

Fix Resolution: v1.34.0

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.