Syntax error in Go programming language conjugates security vulnerability

guest · Sep 26, 2019

Syntax error in Go programming language conjugates security vulnerability
September 26, 2019
https://portswigger.net/daily-swig/...ng-language-conjugates-security-vulnerability

Administrators of Go servers are being encouraged to patch their systems following the discovery of a coding error that, left unaddressed, poses a filter bypass or request smuggling risk.
The vulnerability (CVE-2019-16276) is resolved by updating to either Go 1.13.1 or Go 1.12.10, as appropriate.

In an advisory, the developers of Go – an open source programming language also known as Golang – explain the root cause of the problem: [...]
According to the advisory, the vulnerability could lead to filter bypasses or request smuggling – the latter of which can occur when “requests from separate clients are multiplexed onto the same upstream connection by the proxy”.

“Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications,” the security notice (also posted on GitHub) adds.
Click to expand...

Log in or Sign up

Syntax error in Go programming language conjugates security vulnerability

guest Guest

Log in or Sign up

Syntax error in Go programming language conjugates security vulnerability

guest Guest

Useful Searches