Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml +++ security/vuxml/vuln.xml @@ -58,6 +58,44 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + go -- invalid headers are normalized, allowing request smuggling + + + go + 1.13.1,1 + + + go-devel + g20190925 + + + + +

The Go project reports:

+
net/http (through net/textproto) used to accept and normalize invalid + HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. + If a Go server is used behind a reverse proxy that accepts and forwards + but doesn't normalize such invalid headers, the reverse proxy and the + server can interpret the headers differently. This can lead to filter + bypasses or request smuggling, the latter if requests from separate clients + are multiplexed onto the same connection by the proxy. Such invalid headers + are now rejected by Go servers, and passed without normalization to Go + client applications.
+

+ + + + CVE-2019-16276 + https://github.com/golang/go/issues/34540 + + + 2019-09-25 + 2019-09-26 + + + jenkins -- multiple vulnerabilities