NetSight
IP …
critical9.8

CVE-2015-5739

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP requ…

Impact

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."

Affected products

VendorProductAffected versions
GolangGo
through 1.4.2
FedoraprojectFedora
Versions 21, 22
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6
RedhatEnterprise Linux Server Eus
Versions 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.6

Weakness classification

CWE-444

References