8.1

CVE-2016-5386

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Data is provided by the National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version23
Fedoraproject ≫ Fedora Version24
Oracle ≫ Linux Version7
Golang ≫ Go Version >= 1.0 < 1.6.3
Golang ≫ Go Version1.7 Updaterc1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 87.62% 0.994
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

http://www.kb.cert.org/vuls/id/797896
Third Party Advisory
US Government Resource
https://httpoxy.org/
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1353798
Third Party Advisory
Issue Tracking