Veracode Vulnerability DatabaseVERACODE:4073Request Smuggling
0.013 Low
EPSS
Percentile
85.9%
net/http in github.com/golang/go is vulnerable to request smuggling. This can be done because it does not correctly comply with RFC 7230. If a request is sent with both a Transfer-Encoding header and a Content-Length header, this was being ignored.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/golang/go | eq | 1.4.2 | |
| github.com/golang/go | eq | HEAD | |
| golang | eq | 1.4.2__9.el7 |
References
lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html
lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
seclists.org/oss-sec/2015/q3/237
seclists.org/oss-sec/2015/q3/292
seclists.org/oss-sec/2015/q3/294
seclists.org/oss-sec/2015/q3/301
bugzilla.redhat.com/show_bug.cgi?id=1250352
github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f
github.com/golang/go/issues/12741
groups.google.com/forum/#!topic/golang-nuts/iSIyW4lM4hY
Related
