Lucene search
RedHatRHSA-2016:1538HistoryAug 02, 2016 - 1:46 p.m.
(RHSA-2016:1538) Moderate: golang security, bug fix, and enhancement update
2016-08-0213:46:33
access.redhat.com
22
0.262 Low
EPSS
Percentile
96.8%
The golang packages provide the Go programming language compiler.
The following packages have been upgraded to a newer upstream version: golang (1.6.3). (BZ#1346331)
Security Fix(es):
- An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable “HTTP_PROXY” using the incoming “Proxy” HTTP-request header. The environment variable “HTTP_PROXY” is used by numerous web clients, including Go’s net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack. (CVE-2016-5386)
Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 7 | x86_64 | golang-bin | < 1.6.3-1.el7_2.1 | golang-bin-1.6.3-1.el7_2.1.x86_64.rpm |
| RedHat | 7 | noarch | golang-misc | < 1.6.3-1.el7_2.1 | golang-misc-1.6.3-1.el7_2.1.noarch.rpm |
| RedHat | 7 | noarch | golang-tests | < 1.6.3-1.el7_2.1 | golang-tests-1.6.3-1.el7_2.1.noarch.rpm |
| RedHat | 7 | x86_64 | golang | < 1.6.3-1.el7_2.1 | golang-1.6.3-1.el7_2.1.x86_64.rpm |
| RedHat | 7 | src | golang | < 1.6.3-1.el7_2.1 | golang-1.6.3-1.el7_2.1.src.rpm |
| RedHat | 7 | noarch | golang-docs | < 1.6.3-1.el7_2.1 | golang-docs-1.6.3-1.el7_2.1.noarch.rpm |
| RedHat | 7 | noarch | golang-src | < 1.6.3-1.el7_2.1 | golang-src-1.6.3-1.el7_2.1.noarch.rpm |
Related
centos
centos
golang security update
2016-08-02 21:57:55
nessus
nessus
Oracle Linux 7 : golang (ELSA-2016-1538) (httpoxy)
2016-08-03 00:00:00
RHEL 7 : golang (RHSA-2016:1538) (httpoxy)
2016-08-03 00:00:00
CentOS 7 : golang (CESA-2016:1538) (httpoxy)
2016-08-03 00:00:00
osv
osv
Request smuggling due to improper header parsing in net/http
2022-01-05 21:39:14
GO-2021-0157
2022-01-05 20:00:00
Improper input validation in net/http and net/http/cgi
2022-08-09 17:05:15
openvas
openvas
Fedora Update for golang FEDORA-2015-15618
2015-10-02 00:00:00
Fedora Update for golang FEDORA-2015-12957
2015-08-20 00:00:00
Fedora Update for golang FEDORA-2015-13002
2015-08-20 00:00:00
fedora
fedora
[SECURITY] Fedora 22 Update: golang-1.4.2-3.fc22
2015-08-18 05:23:04
[SECURITY] Fedora 22 Update: golang-1.5.1-0.fc22
2015-10-01 18:59:26
[SECURITY] Fedora 21 Update: golang-1.4.2-3.fc21
2015-08-18 05:21:47
amazon
amazon
Medium: golang, docker
2015-08-24 22:29:00
Medium: golang
2016-08-17 13:30:00
Medium: golang
2016-04-21 16:00:00
freebsd
freebsd
go -- multiple vulnerabilities
2015-07-29 00:00:00
go -- remote denial of service
2016-04-05 00:00:00
cloudfoundry
cloudfoundry
Golang 1.4.3 CVE Fixes | Cloud Foundry
2015-10-07 00:00:00
CVE-2016-3958/CVE-2016-3959: Golang vulnerabilities | Cloud Foundry
2016-12-29 00:00:00
Multiple CVEs: httpoxy | Cloud Foundry
2016-12-21 00:00:00
cve
cve
cvelist
cvelist
nvd
nvd
veracode
veracode
HTTP Header Injection
2019-01-15 09:12:45
HTTP Header Injection
2017-04-27 07:04:20
Request Smuggling
2017-05-02 07:41:09
ubuntucve
ubuntucve
prion
prion
Design/Logic Flaw
2020-02-08 19:15:00
Design/Logic Flaw
2016-07-19 02:00:00
Design/Logic Flaw
2017-10-18 20:29:00
f5
f5
SOL92930514 - GO vulnerability CVE-2016-5386
2016-07-25 00:00:00
K92930514 : GO vulnerability CVE-2016-5386
2016-07-25 00:00:00
redhatcve
redhatcve
CVE-2016-5386
2020-04-07 16:54:43
oraclelinux
oraclelinux
golang security, bug fix, and enhancement update
2016-08-02 00:00:00
huawei
huawei
Security Advisory - A CGI application vulnerability in Some Huawei Products
2017-11-29 00:00:00
mageia
mageia
Updated golang package fixes security vulnerability
2016-09-23 23:57:12
Updated golang package fixes CVE-2016-3959
2016-05-24 01:00:58
hackerone
hackerone
Internet Bug Bounty: Apache HTTP Request Parsing Whitespace Defects
2017-06-29 17:41:22
Internet Bug Bounty: Multiple HTTP Smuggling reports
2019-07-17 22:47:10
ibm
ibm
cert
cert
checkpoint_advisories
checkpoint_advisories
threatpost
threatpost
CGI Script Vulnerability 'Httpoxy' Allows Man-in-the-Middle Attack
2016-07-18 18:00:46
impervablog
impervablog
Python and Go Top the Chart of 2019’s Most Popular Hacking Tools
2020-05-27 09:22:21
oracle
oracle
Oracle Critical Patch Update Advisory - July 2017
2018-03-20 00:00:00