Описание
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to cause cross-user response poisoning, potentially exposing sensitive information or serving unintended content to other users.
Отчет
A flaw of moderate impact was found in the Go standard library net/http package, which is shipped by a broad range of Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset components), Red Hat Enterprise Linux AI, OpenShift Container Platform and other Go-based components across Red Hat's portfolio. When http.Transport sends an HTTP/1 CONNECT request that carries a non-empty request body, the body is written to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the desynchronized connection to the shared idle pool, and the trailing body bytes can be interpreted by the server as a subsequent pipelined request. A remote attacker able to send requests through a reverse proxy (including httputil.ReverseProxy) that forwards CONNECT requests via a shared Transport could exploit this to poison the responses received by other users of the pooled connection, potentially exposing sensitive information or serving unintended content to them. Red Hat rates this flaw MODERATE (CVSS 6.5, limited confidentiality and integrity impact with no availability impact), which is lower than the CISA score of 7.5 (IMPORTANT) based on a confidentiality-only vector; Red Hat's assessment reflects that the exposure requires a shared reverse-proxy deployment that forwards CONNECT requests with bodies and yields low confidentiality and integrity impact. For most affected Red Hat products the fix is deferred because the flaw is rated MODERATE severity with a CVSS score below 7.0, so the residual risk of cross-user response poisoning in such proxy deployments remains until a fix is delivered; for a subset of affected products fixes are being pursued by their maintaining teams, and some affected streams are out of active support.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | helm | Out of support scope | ||
| OpenShift Pipelines | openshift-pipelines-client | Fix deferred | ||
| OpenShift Serverless | kn-workflow-plugin | Fix deferred | ||
| OpenShift Serverless | openshift-serverless-clients | Fix deferred | ||
| OpenShift Service Mesh 3 | istio-proxy | Fix deferred | ||
| OpenShift Service Mesh 3 | openshift-golang-builder-container | Affected | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl30 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-openssl32 | Out of support scope | ||
| Red Hat Ansible Automation Platform 2 | receptor | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
When http.Transport sends an HTTP/1 CONNECT request with a non-empty R ...
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.
EPSS
6.5 Medium
CVSS3