{"action":"Upgrade github.com/tg123/sshpiper to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"1.0.50"}],"component":"github.com/tg123/sshpiper","cve_ids":["CVE-2024-35175"],"ecosystem":"Go","epss":0.0026,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-4w53-6jvp-gg52","id":"tcs_01M5KG346W70J7J6DHD2WMK1P0","modified_at":"2026-03-03T04:55:22.341464Z","published_at":"2024-06-04T15:19:21Z","references":["https://osv.dev/vulnerability/GO-2024-2853","https://github.com/tg123/sshpiper/security/advisories/GHSA-4w53-6jvp-gg52","https://nvd.nist.gov/vuln/detail/CVE-2024-35175","https://github.com/tg123/sshpiper/commit/2ddd69876a1e1119059debc59fe869cb4e754430","https://github.com/tg123/sshpiper/commit/70fb830dca26bea7ced772ce5d834a3e88ae7f53"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-2853","url":"https://osv.dev/vulnerability/GO-2024-2853"}],"summary":"sshpiper's enabling of proxy protocol without proper feature flagging allows faking source address in github.com/tg123/sshpiper"}