PT-2019-15789 · Goahead · Goahead

Published 2019-11-22 · Updated 2020-08-24 · CVE-2019-19240

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoAhead versions prior to 5.0.1

Description The issue arises from the mishandling of redirected HTTP requests that contain a large Host header. Specifically, the GoAhead WebsRedirect utilizes a static host buffer with a limited length, which can overflow. This overflow can cause the copy of the Host header to fail, resulting in an uninitialized buffer. Consequently, uninitialized data may be leaked in a response.

Recommendations For versions prior to 5.0.1, update to version 5.0.1 or later to resolve the issue.

Exploit

Fix

Use of Uninitialized Resource

Memory Corruption

Weakness Enumeration

CWE-908

CWE-787

Related Identifiers

CVE-2019-19240

Affected Products

Goahead

References · 5

• 🔥❌ https://github.com/embedthis/goahead/issues/289 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2019-19240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19240 · Security Note
• ❌ https://github.com/embedthis/goahead/releases/tag/v5.0.1 · Note, Deleted
• ❌ https://github.com/embedthis/goahead/issues/290 · Note, Deleted