Request smuggling due to improper header parsing in net/http
HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
01
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-5741US | critical9.8 | — | ||
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… | ||||
| CVE-2015-5740US | critical9.8 | — | ||
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… | ||||
| CVE-2015-5739US | critical9.8 | — | ||
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://go.dev/cl/11772FIX
- https://go.dev/cl/11810FIX
- https://go.dev/cl/12865FIX
- https://go.dev/cl/13148FIX
- https://go.dev/issue/11930REPORT
- https://go.dev/issue/12027REPORT
- https://go.googlesource.com/go/+/117ddcb83d7f42d6aa72241240af99ded81118e9FIX
- https://go.googlesource.com/go/+/26049f6f9171d1190f3bbe05ec304845cfe6399fFIX
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan