golang: denial of service
| Package(s): | golang | CVE #(s): | CVE-2016-5386 | ||||||||||||||||||||||||||||||||||||||||
| Created: | July 29, 2016 | Updated: | October 14, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entry: The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
Posted Jul 29, 2016 16:24 UTC (Fri)
by ejcx (guest, #109978)
[Link]
cgi scripts that are making credentialed requests might have those credentials exposed to remote servers. Then there's lots of possibilities for cgi scripts that make trust assertions about the server they are connecting to. It is surprisingly a scary attack, but not really a denial of service.
It might be a little pedantic to reclassify a vulnerability, but denial of service bugs get written off regularly as lower priority, and this could have a lot of impact beyond DoS.
golang: denial of service