The net/http package in Go up to and including 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote malicious users to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
fedoraproject fedora 24 |
||
fedoraproject fedora 23 |
||
oracle linux 7 |
||
redhat enterprise linux server aus 7.2 |
||
redhat enterprise linux server 7.0 |
||
redhat enterprise linux server eus 7.2 |
||
golang go |
||
golang go 1.7 |
So you know it's really scary
A dangerous easy-to-exploit vulnerability discovered 15 years ago has reared its head again, leaving server-side website software potentially open to hijackers. The Apache Software Foundation, Red Hat, Ngnix and others have rushed to warn programmers of the so-called httpoxy flaw, specifically: CVE-2016-5385 in PHP; CVE-2016-5386 in Go; CVE-2016-5387 in Apache HTTP server; CVE-2016-5388 in Apache TomCat; CVE-2016-1000109 in PHP-engine HHVM; and CVE-2016-1000110 in Python. This security hole, pre...
Vulmon