CVE-2022-1705

MEDIUM

6.5

Descricao

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

Detalhes CVE

Pontuacao CVSS v3.16.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado8/10/2022

Ultima modificacao3/6/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

golang:go

Fraquezas (CWE)

CWE-444

Referencias

https://go.dev/cl/409874(security@golang.org)

https://go.dev/cl/410714(security@golang.org)

https://go.dev/issue/53188(security@golang.org)

https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f(security@golang.org)

https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE(security@golang.org)

https://pkg.go.dev/vuln/GO-2022-0525(security@golang.org)

https://go.dev/cl/409874(af854a3a-2127-422b-91ae-364da2661108)

https://go.dev/cl/410714(af854a3a-2127-422b-91ae-364da2661108)

https://go.dev/issue/53188(af854a3a-2127-422b-91ae-364da2661108)

https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f(af854a3a-2127-422b-91ae-364da2661108)

https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE(af854a3a-2127-422b-91ae-364da2661108)

https://pkg.go.dev/vuln/GO-2022-0525(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.