https://bugzilla.redhat.com/show_bug.cgi?id=1353798
--- Doc Text *updated* by Summer Long slong@redhat.com --- An input-validation flaw was discovered in the Go progamming language, which set the environmental variable “HTTP_PROXY” based on data from incoming requests (for example, the "Proxy" request header). The environmental variable “HTTP_PROXY” is used by numerous web-client software packages to specify a remote proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a "Man-in-the-Middle" attack. This flaw was given the name HTTPoxy.
golang-updates@lists.fedoraproject.org