CVE-2015-5741: Critical severity golang vulnerability
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2015-5741?
CVE-2015-5741 is a vulnerability in the net/http library in Go before 1.4.3 that allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
How does CVE-2015-5741 affect Golang Go?
CVE-2015-5741 affects Golang Go versions up to and excluding 1.4.3, allowing remote attackers to conduct HTTP request smuggling attacks.
Which versions of Redhat Openstack are affected by CVE-2015-5741?
CVE-2015-5741 affects Redhat Openstack versions 7.0 and 8, allowing remote attackers to conduct HTTP request smuggling attacks.
Which version of Redhat Enterprise Linux is affected by CVE-2015-5741?
CVE-2015-5741 affects Redhat Enterprise Linux version 7.0, allowing remote attackers to conduct HTTP request smuggling attacks.
What is the severity of CVE-2015-5741?
CVE-2015-5741 has a severity rating of 9.8 (Critical).
How can I fix CVE-2015-5741?
To fix CVE-2015-5741, update Golang Go to version 1.4.3 or higher, Redhat Openstack to the latest version, or Redhat Enterprise Linux to a version that includes the fix.