Уязвимость HTTP Request Smuggling в Go из-за некорректной обработки "Transfer-Encoding"
Описание
В HTTP/1 клиенте пакета net/http в Go обнаружена уязвимость, связанная с некорректной обработкой некоторых недопустимых заголовков Transfer-Encoding. В сочетании с промежуточным сервером, который также некорректно обрабатывает эти заголовки, уязвимость может быть использована для выполнения атаки HTTP Request Smuggling.
Затронутые версии ПО
- Go версий до 1.17.12
- Go версий до 1.18.4
Тип уязвимости
Скрытая передача HTTP-запросов (HTTP request smuggling)
Ссылки
- PatchVendor Advisory
- PatchVendor Advisory
- ExploitIssue TrackingPatchVendor Advisory
- PatchVendor Advisory
- Release NotesVendor Advisory
- Vendor Advisory
- PatchVendor Advisory
- PatchVendor Advisory
- ExploitIssue TrackingPatchVendor Advisory
- PatchVendor Advisory
- Release NotesVendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
6.5 Medium
CVSS3
Дефекты
Связанные уязвимости
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 cli ...
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
EPSS
6.5 Medium
CVSS3