https://bugzilla.redhat.com/show_bug.cgi?id=1353798
Tomas Hoger thoger@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Comment #8 is|1 |0 private| | Fixed In Version| |Go 1.6.3, Go 1.7rc2
--- Doc Text *updated* --- An input-validation flaw was discovered in the Go programming language, which set the environment variable "HTTP_PROXY" based on data from incoming HTTP requests (for example, the "Proxy" request header). The environment variable "HTTP_PROXY" is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack.
golang-updates@lists.fedoraproject.org