CVE-2019-9741
Fixed in a distro release EPSS 2%
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.
Products: golang go, debian_linux, fedoraproject fedora, redhat developer_tools, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 8 | golang | 2:1.3.3-1+deb8u2 |
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u3 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u3 |
| Red Hat devtools 2019 | go-toolset-1.11 | 0:1.11.5-2.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-build | 0:1.11.5-2.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-golang | 0:1.11.5-3.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-golang-bin | 0:1.11.5-3.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-golang-docs | 0:1.11.5-3.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-golang-misc | 0:1.11.5-3.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-golang-race | 0:1.11.5-3.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-golang-src | 0:1.11.5-3.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-golang-tests | 0:1.11.5-3.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-runtime | 0:1.11.5-2.el7 |
| Red Hat devtools 2019 | go-toolset-1.11-scldevel | 0:1.11.5-2.el7 |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Red Hat Enterprise Linux 8 | golang | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Red Hat Enterprise Linux 8 | golang-race | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
| Ubuntu 14.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.10 | no fix |
| Ubuntu 16.04 LTS | golang-1.6 | no fix |
| Ubuntu 18.04 LTS | golang-1.10 | no fix |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 18.04 LTS | golang-1.9 | no fix |