CVE-2019-9741: CRLF Injection
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-9741?
CVE-2019-9741 is a vulnerability discovered in net/http in Go 1.11.5 that allows for CRLF injection if the attacker controls a URL parameter.
What is the severity of CVE-2019-9741?
The severity of CVE-2019-9741 is medium (6.1).
How does CVE-2019-9741 affect Golang Go?
CVE-2019-9741 affects Golang Go version 1.11.5.
How does CVE-2019-9741 affect Debian Debian Linux?
CVE-2019-9741 affects Debian Debian Linux version 8.0 and 9.0.
How does CVE-2019-9741 affect Fedora Fedora?
CVE-2019-9741 affects Fedora Fedora version 29.
How does CVE-2019-9741 affect Redhat Developer Tools?
CVE-2019-9741 affects Redhat Developer Tools version 1.0.
How does CVE-2019-9741 affect Redhat Enterprise Linux?
CVE-2019-9741 affects Redhat Enterprise Linux version 8.0.
How do I fix CVE-2019-9741 in Golang Go?
To fix CVE-2019-9741, update Golang Go to version 1.12.1 or higher.
Where can I find more information about CVE-2019-9741?
You can find more information about CVE-2019-9741 at the following references: [Link 1](http://www.securityfocus.com/bid/107432), [Link 2](https://access.redhat.com/errata/RHSA-2019:1300), [Link 3](https://access.redhat.com/errata/RHSA-2019:1519).