Vulnerability CVE-2023-29406: Information
Description
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| golang | sisyphus | 1.20.6-alt1 | 1.22.4-alt1 | ALT-PU-2023-4360-1 | 324737 | Fixed |
| golang | sisyphus_riscv64 | 1.20.6-alt1 | 1.22.4-alt1 | ALT-PU-2023-4375-1 | - | Fixed |
| golang | p10 | 1.19.11-alt1 | 1.21.11-alt1 | ALT-PU-2023-4359-2 | 324732 | Fixed |
| golang | p9 | 1.19.12-alt1 | 1.15.15-alt1 | ALT-PU-2023-5153-1 | 326713 | Testing |
| golang | c10f1 | 1.19.11-alt1 | 1.21.10-alt1 | ALT-PU-2023-4358-2 | 324733 | Fixed |
| golang | c9f2 | 1.19.12-alt1 | 1.20.13-alt1 | ALT-PU-2023-4785-2 | 323137 | Fixed |
| golang | p11 | 1.20.6-alt1 | 1.22.4-alt1 | ALT-PU-2023-4360-1 | 324737 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://groups.google.com/g/golang-announce/c/2q13H6LEEx0 |
|
| https://go.dev/cl/506996 |
|
| https://pkg.go.dev/vuln/GO-2023-1878 |
|
| https://go.dev/issue/60374 |
|
| https://security.netapp.com/advisory/ntap-20230814-0002/ | |
| https://security.gentoo.org/glsa/202311-09 |