CVE-2015-5740 The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Con...
CriticalCVSS 9.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| golang go | <= 1.4.2 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
References
- FEDORA-2015-15619 third-party-advisory vendor-advisory
- FEDORA-2015-15618 third-party-advisory vendor-advisory
- RHSA-2016:1538 third-party-advisory vendor-advisory
- [oss-security] 20150729 CVE Request - Go net/http library - HTTP smuggling mailing-list third-party-advisory
- [oss-security] 20150804 CVE Request - Go net/http library - HTTP smuggling mailing-list third-party-advisory
- [oss-security] 20150805 Re: CVE Request - Go net/http library - HTTP smuggling mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory