CVE-2023-29406: Vulnerability in golang package allows injection of additional headers or entire requests
Summary
CVE-2023-29406: Insufficient sanitization of Host header in net/http. Affects golang across 2 version ranges.
< 1.19.11
>= 1.20.0, < 1.20.6
Fixed in 1.19.11 or 1.20.6, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2023-29406 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that is widely used for developing efficient and reliable software applications. It provides a rich set of libraries and tools for various purposes, including networking and web development. However, a vulnerability has been discovered in the HTTP/1 client of the golang package, which can be exploited to inject additional headers or entire requests. This vulnerability can potentially lead to unauthorized access, data leakage, or other security breaches.
Vulnerability Detail
The HTTP/1 client in the golang package does not properly validate the contents of the Host header. This allows an attacker to craft a malicious Host header that can inject additional headers or even complete requests. By exploiting this vulnerability, an attacker can manipulate the behavior of the HTTP/1 client and potentially perform unauthorized actions or access sensitive information. The fix for this vulnerability ensures that the HTTP/1 client refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.19.111.19.11 -
>= 1.20.0, < 1.20.61.20.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the golang package to the latest version.
Conclusion
The golang package is vulnerable to a critical security issue that allows the injection of additional headers or entire requests. This vulnerability can have severe consequences, including unauthorized access and data leakage. It is crucial to update the golang package to the latest version (1.20.6 or later) to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability allows an attacker to inject additional headers or entire requests, potentially leading to unauthorized access, data leakage, or other security breaches.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit publicly available for this vulnerability. However, it is crucial to apply the fix as soon as possible to mitigate any potential risks.
No, updating the golang package to the fixed version is the only recommended way to mitigate the risk associated with this vulnerability. It is essential to keep your software dependencies up to date to ensure the security of your applications.
You can find more information about this vulnerability, including the technical details and the fix, in the official CVE entry at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29406.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
