PT-2019-4101 · Go+4 · Go+4
Filosottile
·
Published
2019-09-27
·
Updated
2024-06-15
·
CVE-2019-16276
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Go versions 1.12.0 through 1.12.9
Go versions 1.13.0 through 1.13.0
Description
The issue is related to inconsistent interpretation of HTTP requests. This can be exploited by a remote attacker to impact data integrity. Specifically, the
net/http package used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, violating RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently, leading to filter bypasses or request smuggling.Recommendations
For Go versions 1.12.0 through 1.12.9, update to version 1.12.10 or later.
For Go versions 1.13.0 through 1.13.0, update to version 1.13.1 or later.
As a temporary workaround, consider restricting the use of the
net/http package until a patch is available.
Avoid using the net/textproto package in the affected API endpoints until the issue is resolved.Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Go
Red Hat
Suse