CVE-2017-20146

Name	CVE-2017-20146
Description	Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-gorilla-handlers (PTS)	buster	1.3.0-1	fixed
	bullseye	1.4.2-1	fixed
	bookworm	1.5.1-3	fixed
	sid, trixie	1.5.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-gorilla-handlers	source	(unstable)	1.3.0-1

https://github.com/gorilla/handlers/pull/116
https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145 (v1.3.0)