[Bug 1250352] New: golang: HTTP request smuggling in net/http library

List overview All Threads
Download

newer

older

Broken dependencies:...

[Bug 1342329] New: [PATCH] Fix...

Red Hat Bugzilla

5 Aug 2015 5 Aug '15

9:38 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Bug ID: 1250352 Summary: golang: HTTP request smuggling in net/http library Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: amaris@redhat.com CC: admiller@redhat.com, golang@lists.fedoraproject.org, lemenkov@gmail.com, renich@woralelandia.com, s@shk.io, thrcka@redhat.com, vbatts@redhat.com

There have been found potentially exploitable flaws in Golang net/http library affecting versions 1.4.2 and 1.5.

Problems: * Double Content-length headers in a request does not generate a 400 error, the second Content-length is ignored. * Invalid headers are parsed as valid headers (like "Content Length:" with a space in the middle)

Exploitations: In a situation where the net/http agent HTTP communication with the final http clients is using some reverse proxy (reverse proxy cache, SSL terminators, etc), some requests can be made exploiting the net/http HTTP protocol violations.

Attacker could possibly: * bypass security controls on theses previous elements * perform some cache poisoning on these elements * alter the request/response map on these previous elements (for DOS)

CVE request: http://seclists.org/oss-sec/2015/q3/237

Upstream patches: https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9 https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e

-- You are receiving this mail because: You are on the CC list for the bug.

Show replies by date

Red Hat Bugzilla

5 Aug 5 Aug

9:39 a.m.

New subject: [Bug 1250352] golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1250353

--- Comment #1 from Adam Mariš amaris@redhat.com ---

Created golang tracking bugs for this issue:

Affects: fedora-all [bug 1250353]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1250353 [Bug 1250353] golang: HTTP request smuggling in net/http library [fedora-all]

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

9:52 a.m.

New subject: [Bug 1250352] golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1250364

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

10:02 a.m.

New subject: [Bug 1250352] golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Adam Mariš amaris@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

10:03 a.m.

New subject: [Bug 1250352] golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1250374

--- Comment #2 from Adam Mariš amaris@redhat.com ---

Created golang tracking bugs for this issue:

Affects: epel-6 [bug 1250374]

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1250374 [Bug 1250374] golang: HTTP request smuggling in net/http library [epel-6]

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

10:08 a.m.

New subject: [Bug 1250352] golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Adam Mariš amaris@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |golang 1.4.3, golang 1.5

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

10:10 p.m.

New subject: [Bug 1250352] golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #3 from Vincent Batts vbatts@redhat.com --- is https://github.com/golang/go/commit/26049f6f9171d1190f3bbe05ec304845cfe6399f also to be included?

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

6 Aug 6 Aug

9:51 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Martin Prpic mprpic@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

9:53 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #4 from Martin Prpic mprpic@redhat.com --- (In reply to Adam Mariš from comment #0)

...

Upstream patches: https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9

CVE-2015-5739

...

https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f

CVE-2015-5740

...

https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e

CVE-2015-5741

Assignment details at: http://seclists.org/oss-sec/2015/q3/294

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

10:28 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #5 from Martin Prpic mprpic@redhat.com --- (In reply to Vincent Batts from comment #3)

...

is https://github.com/golang/go/commit/26049f6f9171d1190f3bbe05ec304845cfe6399f also to be included?

I requested one in http://seclists.org/oss-sec/2015/q3/299

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

1:40 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #6 from Vincent Batts vbatts@redhat.com --- (In reply to Martin Prpic from comment #5)

...

(In reply to Vincent Batts from comment #3)

...
is https://github.com/golang/go/commit/26049f6f9171d1190f3bbe05ec304845cfe6399f also to be included?

I requested one in http://seclists.org/oss-sec/2015/q3/299

Thanks. This commit does not apply directly for go1.4.2 presently. I'm investigating that.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

18 Aug 18 Aug

6:21 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352 Bug 1250352 depends on bug 1250353, which changed state.

Bug 1250353 Summary: golang: HTTP request smuggling in net/http library [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1250353

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

6:21 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352 Bug 1250352 depends on bug 1250374, which changed state.

Bug 1250374 Summary: golang: HTTP request smuggling in net/http library [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1250374

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

6:21 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #7 from Fedora Update System updates@fedoraproject.org --- golang-1.4.2-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

6:23 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #8 from Fedora Update System updates@fedoraproject.org --- golang-1.4.2-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

4 Sep 4 Sep

4:47 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352 Bug 1250352 depends on bug 1250374, which changed state.

Bug 1250374 Summary: golang: HTTP request smuggling in net/http library [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1250374

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

4:47 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352 Bug 1250352 depends on bug 1250353, which changed state.

Bug 1250353 Summary: golang: HTTP request smuggling in net/http library [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1250353

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

1 Oct 1 Oct

7:50 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #9 from Fedora Update System updates@fedoraproject.org --- golang-1.5.1-0.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

7:56 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #10 from Fedora Update System updates@fedoraproject.org --- golang-1.5.1-0.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

7:56 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352 Bug 1250352 depends on bug 1250353, which changed state.

Bug 1250353 Summary: golang: HTTP request smuggling in net/http library [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1250353

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

7:56 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352 Bug 1250352 depends on bug 1250374, which changed state.

Bug 1250374 Summary: golang: HTTP request smuggling in net/http library [epel-6] https://bugzilla.redhat.com/show_bug.cgi?id=1250374

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

9:22 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Comment #11 from Fedora Update System updates@fedoraproject.org --- golang-1.5.1-0.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

18 Apr 18 Apr

1:26 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Summer Long slong@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

2:15 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Summer Long slong@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1327920

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

2:21 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Summer Long slong@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1327921

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

27 Apr 27 Apr

3:13 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Summer Long slong@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |slong@redhat.com

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

19 May 19 May

8:09 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Huzaifa S. Sidhpurwala huzaifas@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1323912

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

6 Jun 6 Jun

6:07 p.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

Eric Christensen sparks@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |sparks@redhat.com

-- You are receiving this mail because: You are on the CC list for the bug.

Red Hat Bugzilla

7 Jun 7 Jun

12:18 a.m.

New subject: [Bug 1250352] CVE-2015-5739 CVE-2015-5740 CVE-2015-5741 golang: HTTP request smuggling in net/http library

https://bugzilla.redhat.com/show_bug.cgi?id=1250352

--- Doc Text *updated* by Summer Long slong@redhat.com --- HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error (the second field is ignored), and invalid fields are parsed as valid (for example, "Content Length:" with a space in the middle is accepted). A non-authenticated attacker could exploit these flaws to bypass security controls, perform web-cache poisoning, or alter the request/response map (denial of service).

-- You are receiving this mail because: You are on the CC list for the bug.

3101

Age (days ago)

3407

Last active (days ago)

golang@lists.fedoraproject.org

28 comments

1 participants

tags (0)

participants (1)

Red Hat Bugzilla