CVE-2015-5739
Fixed in a distro release EPSS 10%
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
Products: golang go, fedoraproject fedora, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | stdlib | 1.4.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 7 | golang | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-bin | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-docs | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-misc | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-src | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-tests | 0:1.6.3-1.el7_2.1 |
| Ubuntu 14.04 LTS | gccgo-4.9 | no fix |