Lack of data validation In golang
Description
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel8 | 0:1.11.5-2.module+el8.0.0+3175+261ae921 | ||
rpm rhel7 | - | - |
Aliases
1. 2. 3.