GO-2022-0525

vendorUSosv

Improper sanitization of Transfer-Encoding headers in net/http

view advisory published 2022-07-25Licence: per source

The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-1705US	medium6.5	1.45% (73rd)	—	2022-08-10
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/409874FIX
https://go.dev/cl/410714FIX
https://go.dev/issue/53188REPORT
https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5fFIX
https://groups.google.com/g/golang-announce/c/nqrv9fbR0zEWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan