PT-2023-9031 · Golang+11 · Golang+11
Bartek Nowotarski
·
Publicado
2023-07-11
·
Atualizado
2026-02-18
·
CVE-2023-29406
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Golang (affected versions not specified)
Description
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With the fix, the HTTP/1 client now refuses to send requests containing an invalid
Request.Host or Request.URL.Host value. The issue allows a remote attacker to execute arbitrary code by exploiting the vulnerability.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Golang
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu