PT-2017-6889 · Google+3 · Go+3
Régis Leroy
·
Publicado
2015-09-28
·
Atualizado
2022-01-05
·
CVE-2015-5740
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Go versions prior to 1.4.3
Description
The issue arises from improper parsing of HTTP headers, allowing remote attackers to conduct HTTP request smuggling attacks. This can be achieved via a request that contains
Content-Length and Transfer-Encoding header fields.Recommendations
For versions prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the net/http library until a patch is applied. Avoid using the
Content-Length and Transfer-Encoding header fields in requests to minimize the risk of exploitation.Correção
HTTP Request/Response Smuggling
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Go
Red Hat