CVEvulnerability

CVE-2016-5386

8.1 HIGH Published 2016-07-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-07-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-284

Description

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Affected configurations

• fedoraproject fedora 23 • fedoraproject fedora 24 • oracle linux 7 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.2 • redhat enterprise linux server eus 7.2 • golang go (>= 1.0 < 1.6.3) • golang go 1.7

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References