Page MenuHomeFreeBSD
Files F144801517

D21802.diff
No OneTemporary
Actions

D21802.diff
View Options

Index: security/vuxml/vuln.xml
===================================================================
--- security/vuxml/vuln.xml
+++ security/vuxml/vuln.xml
@@ -58,6 +58,44 @@
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="a92dcc5c-e05c-11e9-b589-10c37b4ac2ea">
+ <topic>go -- invalid headers are normalized, allowing request smuggling</topic>
+ <affects>
+ <package>
+ <name>go</name>
+ <range><lt>1.13.1,1</lt></range>
+ </package>
+ <package>
+ <name>go-devel</name>
+ <range><lt>g20190925</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Go project reports:</p>
+ <blockquote cite="https://github.com/golang/go/issues/34540">
+ <p>net/http (through net/textproto) used to accept and normalize invalid
+ HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.
+ If a Go server is used behind a reverse proxy that accepts and forwards
+ but doesn't normalize such invalid headers, the reverse proxy and the
+ server can interpret the headers differently. This can lead to filter
+ bypasses or request smuggling, the latter if requests from separate clients
+ are multiplexed onto the same connection by the proxy. Such invalid headers
+ are now rejected by Go servers, and passed without normalization to Go
+ client applications.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2019-16276</cvename>
+ <url>https://github.com/golang/go/issues/34540</url>
+ </references>
+ <dates>
+ <discovery>2019-09-25</discovery>
+ <entry>2019-09-26</entry>
+ </dates>
+ </vuln>
+
<vuln vid="9720bb39-f82a-402f-9fe4-e2c875bdda83">
<topic>jenkins -- multiple vulnerabilities</topic>
<affects>

File Metadata

Mime Type
text/plain
Expires
Fri, Feb 13, 7:14 PM (11 h, 35 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
28680016
Default Alt Text
D21802.diff (1 KB)

Event Timeline