PT-2017-6888 · Google+3 · Go+3

Régis Leroy · Published 2015-09-28 · Updated 2022-01-05 · CVE-2015-5739

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.4.3

Description The issue arises from improper parsing of HTTP header keys in the net/http library, specifically when a space is used instead of a hyphen, as seen in "Content Length" instead of "Content-Length". This allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.

Recommendations For Go versions prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the net/http library until a patch is applied. Avoid using the Content-Length and Transfer-Encoding header fields in the affected API endpoints until the issue is resolved.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALT-PU-2015-1812

CESA-2016_1538

CVE-2015-5739

GO-2021-0159

RHSA-2016:1538

RHSA-2016_1538

Affected Products

Alt Linux

Centos

Go

Red Hat

References · 43

• https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1250352 · Patch
• https://ubuntu.com/security/CVE-2015-5739 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5386 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5741 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3959 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5739 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5739 · Security Note
• https://osv.dev/vulnerability/GO-2021-0159 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5739 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5739 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5740 · Security Note