UBUNTU-CVE-2023-29406
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
02 / AFFECTED SOFTWARE
Affected packages
1 explicit affected versions
2 explicit affected versions
10 explicit affected versions
8 explicit affected versions
2 explicit affected versions
5 explicit affected versions
10 explicit affected versions
9 explicit affected versions
2 explicit affected versions
2 explicit affected versions
4 explicit affected versions
7 explicit affected versions
2 explicit affected versions
4 explicit affected versions
1 explicit affected versions
4 explicit affected versions
2 explicit affected versions
2 explicit affected versions
3 explicit affected versions
4 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
05 / REFERENCES
Further evidence
- https://github.com/golang/go/commit/312920c00aac9897b2a0693e752390b5b0711a5a
- https://github.com/golang/go/commit/5fa6923b1ea891400153d04ddf1545e23b40041b
- https://github.com/golang/go/issues/60374
- https://go.dev/cl/506996
- https://go.dev/issue/60374
- https://groups.google.com/g/golang-announce/c/2q13H6LEEx0
- https://pkg.go.dev/vuln/GO-2023-1878
- https://ubuntu.com/security/CVE-2023-29406
- https://ubuntu.com/security/notices/USN-7061-1
- https://ubuntu.com/security/notices/USN-7109-1
- https://www.cve.org/CVERecord?id=CVE-2023-29406