9.8

CVE-2015-5739

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Golang ≫ Go Version <= 1.4.2
Fedoraproject ≫ Fedora Version21
Fedoraproject ≫ Fedora Version22
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 9.63% 0.949
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

http://rhn.redhat.com/errata/RHSA-2016-1538.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
Third Party Advisory
http://seclists.org/oss-sec/2015/q3/237
Third Party Advisory
Mailing List
http://seclists.org/oss-sec/2015/q3/292
Third Party Advisory
Mailing List
http://seclists.org/oss-sec/2015/q3/294
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/76281
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1250352
Patch
Third Party Advisory
Issue Tracking
https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
Patch
Third Party Advisory
Issue Tracking