PT-2017-6888 · Google+3 · Go+3
Régis Leroy
·
Publicado
2015-09-28
·
Atualizado
2022-01-05
·
CVE-2015-5739
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions prior to 1.4.3
Description
The issue arises from improper parsing of HTTP header keys in the net/http library, specifically when a space is used instead of a hyphen, as seen in "Content Length" instead of "Content-Length". This allows remote attackers to conduct HTTP request smuggling attacks via a request that contains
Content-Length and Transfer-Encoding header fields.Recommendations
For Go versions prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the
net/http library until a patch is applied. Avoid using the Content-Length and Transfer-Encoding header fields in the affected API endpoints until the issue is resolved.Correção
HTTP Request/Response Smuggling
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Go
Red Hat