CVE-2019-14809: Critical severity Golang Go vulnerability
A vulnerability was found in net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
Reference: https://github.com/golang/go/issues/29098
Upstream commit: https://github.com/golang/go/commit/61bb56ad63992a3199acc55b2537c8355ef887b6
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/golang-1.11to a version that resolves this vulnerability.Fixed in 1.11.6-1+deb10u4Fixed in 1.11.6-1+deb10u7 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.12.8 - Upgrade
Upgrade
golang/go (net/url)to a version that resolves this vulnerability.Fixed in 1.11.13 - Upgrade
Upgrade
golang/go (net/url)to a version that resolves this vulnerability.Fixed in 1.12.8
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14809?
CVE-2019-14809 has been categorized with a severity rating that indicates it could lead to an authorization bypass in certain applications.
How do I fix CVE-2019-14809?
To fix CVE-2019-14809, you should upgrade to Go version 1.11.13, 1.12.8, or later.
Which versions of Go are affected by CVE-2019-14809?
CVE-2019-14809 affects Go versions prior to 1.11.13 and 1.12.x before 1.12.8.
What applications are at risk due to CVE-2019-14809?
Applications utilizing the net/url package in vulnerable versions of Go may be at risk of authorization bypass due to malformed hosts in URLs.
Is CVE-2019-14809 a remote attack vulnerability?
CVE-2019-14809 can potentially be exploited in scenarios where an attacker can manipulate URL inputs to bypass authorization.