CVE-2015-5740
Fixed in a distro release EPSS 4%
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
Products: golang go, fedoraproject fedora, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | stdlib | 1.4.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 7 | golang | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-bin | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-docs | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-misc | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-src | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-tests | 0:1.6.3-1.el7_2.1 |
| Ubuntu 14.04 LTS | gccgo-4.9 | no fix |