CVE-2015-5741
Fixed in a distro release EPSS 3%
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
Products: golang go, redhat openstack, redhat enterprise_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | stdlib | 1.4.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 7 | golang | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-bin | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-docs | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-misc | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-src | 0:1.6.3-1.el7_2.1 |
| Red Hat Enterprise Linux 7 | golang-tests | 0:1.6.3-1.el7_2.1 |
| Ubuntu 14.04 LTS | gccgo-4.9 | no fix |