oss-sec mailing list archives
CVE Request - Go net/http library - HTTP smuggling
From: Jason Buberel <jbuberel () google com>
Date: Wed, 29 Jul 2015 15:15:45 +0000
Hello OSS Security Community, The Go open source project has received notification of an HTTP request smuggling vulnerability in the net/http library ( http://golang.org/pkg/net/http/). The vulnerability was identified in the 1.4.2 release version (http://golang.org/dl) and in the 1.5 release branch. Patches have already been applied to the 1.5 release branch, and will be ported to the 1.4.2 release branch. We will then create a 1.4.3 release. We are requesting a CVE ID in order to coordinate updates with distributions that include binary packages for the Go programming language. We will also announce and request that all Go programs using the net/http package that were compiled with version 1.4.2 or earlier be recompiled with 1.4.3 or 1.5 (when released) due to the static linking nature of the Go toolchain. Please let me know if you need additional information. Regards, Jason Buberel Product Manager, Go Google, Inc.
Current thread:
- CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Jul 29)
- Re: CVE Request - Go net/http library - HTTP smuggling Florian Weimer (Jul 29)
- Re: CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Jul 29)
- Re: CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Aug 04)
- Re: CVE Request - Go net/http library - HTTP smuggling cve-assign (Aug 05)
- Re: Re: CVE Request - Go net/http library - HTTP smuggling Martin Prpic (Aug 06)
- Re: Re: CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Aug 06)
- Re: Re: CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Aug 10)
- Re: Re: CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Aug 12)
- Re: Re: CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Aug 12)
- Re: CVE Request - Go net/http library - HTTP smuggling Jason Buberel (Jul 29)
- Re: CVE Request - Go net/http library - HTTP smuggling Florian Weimer (Jul 29)