CentOS ProjectCESA-2016:1538golang security update
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.262 Low
EPSS
Percentile
96.8%
CentOS Errata and Security Advisory CESA-2016:1538
The golang packages provide the Go programming language compiler.
The following packages have been upgraded to a newer upstream version: golang (1.6.3). (BZ#1346331)
Security Fix(es):
- An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable “HTTP_PROXY” using the incoming “Proxy” HTTP-request header. The environment variable “HTTP_PROXY” is used by numerous web clients, including Go’s net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack. (CVE-2016-5386)
Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2016-August/084167.html
Affected packages:
golang
golang-bin
golang-docs
golang-misc
golang-src
golang-tests
Upstream details at:
https://access.redhat.com/errata/RHSA-2016:1538
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| CentOS | 7 | x86_64 | golang | < 1.6.3-1.el7_2.1 | golang-1.6.3-1.el7_2.1.x86_64.rpm |
| CentOS | 7 | x86_64 | golang-bin | < 1.6.3-1.el7_2.1 | golang-bin-1.6.3-1.el7_2.1.x86_64.rpm |
| CentOS | 7 | noarch | golang-docs | < 1.6.3-1.el7_2.1 | golang-docs-1.6.3-1.el7_2.1.noarch.rpm |
| CentOS | 7 | noarch | golang-misc | < 1.6.3-1.el7_2.1 | golang-misc-1.6.3-1.el7_2.1.noarch.rpm |
| CentOS | 7 | noarch | golang-src | < 1.6.3-1.el7_2.1 | golang-src-1.6.3-1.el7_2.1.noarch.rpm |
| CentOS | 7 | noarch | golang-tests | < 1.6.3-1.el7_2.1 | golang-tests-1.6.3-1.el7_2.1.noarch.rpm |
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.262 Low
EPSS
Percentile
96.8%