Impact: Moderate Public Date: 2019-08-13 CWE: CWE-285 Bugzilla: 1743129: CVE-2019-14809 golang: malformed hosts in URLs leads to authorization bypass net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2019-14809 from the MITRE CVE dictionary dictionary and NIST NVD.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 7.5 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity Impact | High |
| Availability Impact | None |
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 9.0 Operational Tools for RHEL 7 | golang | Under investigation |
| Red Hat Gluster Storage 3 | golang | Under investigation |
| Red Hat Enterprise Linux OpenStack Platform 8.0 Operational Tools for RHEL 7 | golang | Under investigation |
| Red Hat Enterprise Linux 8 | golang | Under investigation |
| Red Hat Enterprise Linux 7 | golang | Under investigation |
| Red Hat Ceph Storage 3 | golang | Under investigation |
| Red Hat Ceph Storage 2 | golang | Under investigation |
Vulmon