modules:
  - module: github.com/zalando/skipper
    versions:
      - fixed: 0.13.237
    vulnerable_at: 0.13.236
    packages:
      - package: github.com/zalando/skipper
        symbols:
          - proxyFromHeader
          - forwardToProxy
        derived_symbols:
          - Proxy.ServeHTTP
          - context.Loopback
description: |-
    An attacker can access the internal metadata server or other unauthenticated
    URLs by adding a specific header (X-Skipper-Proxy) to the http request.
cves:
  - CVE-2022-38580
ghsas:
  - GHSA-f2rj-m42r-6jm2
references:
  - advisory: https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2
  - fix: https://github.com/zalando/skipper/pull/2058
  - web: https://github.com/zalando/skipper/releases/tag/v0.13.237