Improper sanitization of Transfer-Encoding headers in net/http
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-1705US | medium6.5 | — | ||
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate… | ||||
02
references
External citations — patches, advisories, analysis.
- https://go.dev/cl/409874ADVISORY
- https://go.dev/cl/410714ADVISORY
- https://go.dev/issue/53188ADVISORY
- https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5fADVISORY
- https://groups.google.com/g/golang-announce/c/nqrv9fbR0zEADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2022-1705WEB
- https://pkg.go.dev/vuln/GO-2022-0525ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan