CVE-2015-5739
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
Request smuggling due to improper header parsing in net/http
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
Vendor advisory: cve@mitre.org — https://bugzilla.redhat.com/show_bug.cgi?id=1250352
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 7.0 | affected | |
| fedora | 21 | affected | |
| fedora | 22 | affected | |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | stdlib | <1.4.3 | 1.4.3 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| golang | go | {"endIncluding":"1.4.2"} | |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
- http://rhn.redhat.com/errata/RHSA-2016-1538.html
- http://seclists.org/oss-sec/2015/q3/237
- http://seclists.org/oss-sec/2015/q3/292
- http://seclists.org/oss-sec/2015/q3/294
- http://www.securityfocus.com/bid/76281
- https://bugzilla.redhat.com/show_bug.cgi?id=1250352
- https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
- https://go.dev/cl/13148
- https://go.googlesource.com/go/+/26049f6f9171d1190f3bbe05ec304845cfe6399f
- https://go.dev/cl/11772
- https://go.dev/cl/11810
- https://go.dev/cl/12865
- https://go.googlesource.com/go/+/117ddcb83d7f42d6aa72241240af99ded81118e9
- https://go.googlesource.com/go/+/300d9a21583e7cf0149a778a0611e76ff7c6680f
- https://go.googlesource.com/go/+/c2db5f4ccc61ba7df96a747e268a277b802cbb87
- https://go.dev/issue/12027
- https://go.dev/issue/11930
- https://groups.google.com/g/golang-announce/c/iSIyW4lM4hY/m/ADuQR4DiDwAJ
CWEs
CWE-444
Verify integrity in audit chain (admin only). AS-IS.