Описание
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
Меры по смягчению последствий
This flaw has no mitigation for any affected golang package versions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 2 | golang | Affected | ||
| Red Hat Ceph Storage 3 | golang | Affected | ||
| Red Hat Enterprise Linux 7 | golang | Will not fix | ||
| Red Hat OpenStack Platform 9 (Mitaka) Operational Tools | golang | Out of support scope | ||
| Red Hat Storage 3 | golang | Affected | ||
| Red Hat Developer Tools | go-toolset-1.12 | Fixed | RHEA-2019:4179 | 10.12.2019 |
| Red Hat Developer Tools | go-toolset-1.12-golang | Fixed | RHEA-2019:4179 | 10.12.2019 |
| Red Hat Enterprise Linux 8 | go-toolset | Fixed | RHSA-2019:3433 | 05.11.2019 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malfo ...
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
ELSA-2019-3433: go-toolset:ol8 security, bug fix, and enhancement update (MODERATE)
EPSS
7.5 High
CVSS3