id: GO-2023-1526
modules:
    - module: github.com/hakobe/paranoidhttp
      versions:
        - fixed: 0.3.0
      vulnerable_at: 0.2.0
      packages:
        - package: github.com/hakobe/paranoidhttp
          symbols:
            - safeAddr
summary: Server-side request forgery in github.com/hakobe/paranoidhttp
description: |-
    Paranoidhttp before is vulnerable to SSRF because [::] is equivalent to the
    127.0.0.1 address, but does not match the filter for private addresses.
cves:
    - CVE-2023-24623
ghsas:
    - GHSA-v9mp-j8g7-2q6m
references:
    - web: https://github.com/hakobe/paranoidhttp/blob/master/CHANGELOG.md#v030-2023-01-19
    - fix: https://github.com/hakobe/paranoidhttp/commit/07f671da14ce63a80f4e52432b32e8d178d75fd3
    - web: https://github.com/hakobe/paranoidhttp/compare/v0.2.0...v0.3.0
review_status: REVIEWED