PT-2017-6889 · Google+3 · Go+3

Régis Leroy · Published 2015-09-28 · Updated 2022-01-05 · CVE-2015-5740

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.4.3

Description The issue arises from improper parsing of HTTP headers, allowing remote attackers to conduct HTTP request smuggling attacks. This can be achieved via a request that contains Content-Length and Transfer-Encoding header fields.

Recommendations For versions prior to 1.4.3, update to version 1.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the net/http library until a patch is applied. Avoid using the Content-Length and Transfer-Encoding header fields in requests to minimize the risk of exploitation.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALT-PU-2015-1812

CESA-2016_1538

CVE-2015-5740

GO-2021-0159

RHSA-2016:1538

RHSA-2016_1538

Affected Products

Alt Linux

Centos

Go

Red Hat

References · 42

• https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f · Patch
• https://ubuntu.com/security/CVE-2015-5740 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1250352 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5386 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5741 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-5740 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3959 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-5740 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5739 · Security Note
• https://osv.dev/vulnerability/GO-2021-0159 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1812 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5740 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5740 · Vendor Advisory