PT-2022-14059 · Go+9 · Go+9

Zeyu Zhang · Publicado 2022-07-12 · Atualizado 2026-03-06 · CVE-2022-1705

Positive Technologies (AI Summary) · Pt

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Nome do software vulnerável e versões afetadas

Versões do Go anteriores à 1.17.12

Versões do Go anteriores à 1.18.4

Descrição

O problema decorre da aceitação de alguns cabeçalhos Transfer-Encoding inválidos no cliente HTTP/1 em net/http. Isso pode levar ao contrabando de solicitações HTTP se combinado com um servidor intermediário que também falhe em rejeitar o cabeçalho como inválido. O cliente HTTP/1 aceitou alguns cabeçalhos Transfer-Encoding inválidos como indicando uma codificação “chunked”.

Recomendações

Para versões do Go anteriores à 1.17.12, atualize para a versão 1.17.12 ou posterior.

Para versões do Go anteriores à 1.18.4, atualize para a versão 1.18.4 ou posterior.

Exploit

Correção

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

ALSA-2022:5775

ALSA-2022:5799

ALSA-2022:7129

ALSA-2022:7519

ALSA-2022:7529

ALSA-2022:7648

ALSA-2022:8057

ALSA-2022:8098

ALSA-2022:8250

ALSA-2023:2357

ALSA-2023:2758

ALSA-2023:2802

ALT-PU-2022-2310

ALT-PU-2022-2316

ALT-PU-2022-2873

ALT-PU-2023-1205

AZL-10529

AZL-79116

BIT-GOLANG-2022-1705

CESA-2022_5775

CESA-2022_7129

CESA-2022_7519

CESA-2022_7529

CESA-2022_7648

CESA-2023_2758

CESA-2023_2802

CVE-2022-1705

GO-2022-0525

MGASA-2022-0262

OESA-2022-1783

OPENSUSE-SU-2022_2671-1

OPENSUSE-SU-2022_2672-1

OPENSUSE-SU-2024:12189-1

OPENSUSE-SU-2024:12190-1

RHSA-2022:5068

RHSA-2022:5775

RHSA-2022:5799

RHSA-2022:5866

RHSA-2022:6042

RHSA-2022:6113

RHSA-2022:7129

RHSA-2022:7398

RHSA-2022:7519

RHSA-2022:7529

RHSA-2022:7648

RHSA-2022:8057

RHSA-2022:8098

RHSA-2022:8250

RHSA-2022:8626

RHSA-2022_5775

RHSA-2022_5799

RHSA-2022_7129

RHSA-2022_7519

RHSA-2022_7529

RHSA-2022_7648

RHSA-2022_8057

RHSA-2022_8098

RHSA-2022_8250

RHSA-2023:0407

RHSA-2023:1275

RHSA-2023:2357

RHSA-2023:2758

RHSA-2023:2802

RHSA-2023_2357

RHSA-2023_2758

RHSA-2023_2802

RLSA-2022:5775

RLSA-2022:5799

RLSA-2022:7129

RLSA-2022:7519

RLSA-2022:7529

RLSA-2022:7648

RLSA-2022:8057

RLSA-2022:8098

RLSA-2022:8250

SUSE-SU-2022:2671-1

SUSE-SU-2022:2672-1

SUSE-SU-2022_2671-1

SUSE-SU-2022_2672-1

SUSE-SU-2023:2312-1

SUSE-SU-2023_2312-1

USN-6038-1

USN-6038-2

Produtos afetados

Alt Linux

Almalinux

Centos

Debian

Go

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

Referências · 278

• 🔥 https://go.dev/issue/53188 · Exploit
• https://github.com/golang/go/commit/e5017a93fcde94f09836200bca55324af037ee5f · Nota
• https://ubuntu.com/security/CVE-2022-30629 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2022-30630 · Nota
• https://access.redhat.com/security/cve/CVE-2022-28131 · Nota
• https://errata.rockylinux.org/RLSA-2022:5775 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2022-8250.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=2113814 · Nota
• https://access.redhat.com/security/cve/CVE-2020-28852 · Nota
• https://errata.almalinux.org/9/ALSA-2022-8057.html · Aviso do Fabricante
• https://pkg.go.dev/vuln/GO-2022-0525 · Aviso do Fabricante
• https://bugzilla.redhat.com/2092793 · Nota
• https://osv.dev/vulnerability/ALSA-2023:2357 · Aviso do Fabricante
• https://errata.rockylinux.org/RLSA-2022:7519 · Aviso do Fabricante
• https://osv.dev/vulnerability/RLSA-2022:8098 · Aviso do Fabricante