Interpretation Conflict Affecting github.com/goauthentik/authentik package, versions <2023.4.3 >=2023.5.0 <2023.5.5
Threat Intelligence
EPSS
0.08% (36th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMGOAUTHENTIKAUTHENTIK-5759295
- published 7 Jul 2023
- disclosed 7 Jul 2023
- credit thijsa
Introduced: 7 Jul 2023
CVE-2023-36456 Open this link in a new tabHow to fix?
Upgrade github.com/goauthentik/authentik to version 2023.4.3, 2023.5.5 or higher.
Overview
Affected versions of this package are vulnerable to Interpretation Conflict due to not verifying the source of the X-Forwarded-For and X-Real-IP headers both in the Python code and the go code.
Note:
Only authentik setups that are directly accessible by users without a reverse proxy are susceptible to this.
References
CVSS Scores
version 3.1