9.8

CVE-2015-5740

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Golang ≫ Go Version <= 1.4.2
Fedoraproject ≫ Fedora Version21
Fedoraproject ≫ Fedora Version22
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.66% 0.882
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

http://rhn.redhat.com/errata/RHSA-2016-1538.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
Third Party Advisory
http://seclists.org/oss-sec/2015/q3/237
Third Party Advisory
Mailing List
http://seclists.org/oss-sec/2015/q3/292
Third Party Advisory
Mailing List
http://seclists.org/oss-sec/2015/q3/294
Third Party Advisory
Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=1250352
Patch
Third Party Advisory
Issue Tracking
https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f
Patch
Third Party Advisory
Issue Tracking