kritik
CVE-2015-5739
golang: HTTP request smuggling in net/http library
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Amazon (orta).
Açıklama
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | docker, docker-devel, docker-pkg-devel ve 21 tane daha | 1.6.2-1.3.amzn1 ve 1 tane daha |
| debian 7 | golang | düzeltme belirtilmemiş |
| debian 8 | golang | düzeltme belirtilmemiş |
| go::The Go Vulnerability Database | stdlib | 1.4.3 |
| rapidfort ubuntu 20.04 | golang | düzeltme belirtilmemiş |
| rapidfort ubuntu 22.04 | golang | düzeltme belirtilmemiş |
| rapidfort ubuntu 24.04 | golang | düzeltme belirtilmemiş |
| Red Hat | golang, golang-pkg-bin-linux-amd64, golang-pkg-linux-amd64 ve 1 tane daha | düzeltme belirtilmemiş |
8 kaynaktaki 34 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | docker | 1.6.2-1.3.amzn1 |
| amazon linux 1 | docker-devel | 1.6.2-1.3.amzn1 |
| amazon linux 1 | docker-pkg-devel | 1.6.2-1.3.amzn1 |
| amazon linux 1 | golang | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-bin-linux-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-bin-linux-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-darwin-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-darwin-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-freebsd-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-freebsd-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-freebsd-arm | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-linux-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-linux-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-linux-arm | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-netbsd-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-netbsd-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-netbsd-arm | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-openbsd-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-openbsd-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-plan9-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-plan9-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-windows-386 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-pkg-windows-amd64 | 1.4.2-3.16.amzn1 |
| amazon linux 1 | golang-src | 1.4.2-3.16.amzn1 |
| debian 7 | golang | düzeltme belirtilmemiş |
| debian 8 | golang | düzeltme belirtilmemiş |
| go::The Go Vulnerability Database | stdlib | 1.4.3 |
| rapidfort ubuntu 20.04 | golang | düzeltme belirtilmemiş |
| rapidfort ubuntu 22.04 | golang | düzeltme belirtilmemiş |
| rapidfort ubuntu 24.04 | golang | düzeltme belirtilmemiş |
| Red Hat | golang | düzeltme belirtilmemiş |
| Red Hat | golang-pkg-bin-linux-amd64 | düzeltme belirtilmemiş |
| Red Hat | golang-pkg-linux-amd64 | düzeltme belirtilmemiş |
| Red Hat | golang-src | düzeltme belirtilmemiş |
Referanslar
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
- http://rhn.redhat.com/errata/RHSA-2016-1538.html
- http://seclists.org/oss-sec/2015/q3/237
- http://seclists.org/oss-sec/2015/q3/292
- http://seclists.org/oss-sec/2015/q3/294
- http://www.securityfocus.com/bid/76281
- https://access.redhat.com/security/cve/CVE-2015-5739
24 referansın hepsi
- https://bugzilla.redhat.com/show_bug.cgi?id=1250352
- https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
- https://go.dev/cl/11772
- https://go.dev/cl/11810
- https://go.dev/cl/12865
- https://go.dev/cl/13148
- https://go.dev/issue/11930
- https://go.dev/issue/12027
- https://go.googlesource.com/go/+/117ddcb83d7f42d6aa72241240af99ded81118e9
- https://go.googlesource.com/go/+/26049f6f9171d1190f3bbe05ec304845cfe6399f
- https://go.googlesource.com/go/+/300d9a21583e7cf0149a778a0611e76ff7c6680f
- https://go.googlesource.com/go/+/c2db5f4ccc61ba7df96a747e268a277b802cbb87
- https://groups.google.com/g/golang-announce/c/iSIyW4lM4hY/m/ADuQR4DiDwAJ
- https://nvd.nist.gov/vuln/detail/CVE-2015-5739
- https://pkg.go.dev/vuln/GO-2021-0159
- https://www.cve.org/CVERecord?id=CVE-2015-5739