HTTP Response Splitting Affecting golang-race package, versions <0:1.11.5-2.module+el8.0.0+3175+261ae921


Severity

Recommended
0.0
medium
0
10

Based on CentOS security rating.

Threat Intelligence

EPSS
0.49% (77th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-GOLANGRACE-1983870
  • published26 Jul 2021
  • disclosed13 Mar 2019

Introduced: 13 Mar 2019

CVE-2019-9741  (opens in a new tab)
CWE-113  (opens in a new tab)

How to fix?

Upgrade Centos:8 golang-race to version 0:1.11.5-2.module+el8.0.0+3175+261ae921 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream golang-race package and not the golang-race package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CVSS Scores

version 3.1