First published: Tue Jul 11 2023(Updated: )
Golang Go is vulnerable to HTTP header injection, caused by improper contents validation of Host header by the HTTP/1 client. By persuading a victim to visit a specially crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
Credit: security@golang.org security@golang.org
Affected Software | Affected Version | How to fix |
---|---|---|
Golang Go | >=1.20.0<1.20.6 | |
Golang Go | <1.19.11 | |
IBM Cloud Pak for Business Automation | <=V23.0.1 - V23.0.1-IF002 | |
IBM Cloud Pak for Business Automation | <=V21.0.3 - V21.0.3-IF024 | |
IBM Cloud Pak for Business Automation | <=V22.0.2 - V22.0.2-IF006 and later fixesV22.0.1 - V22.0.1-IF006 and later fixesV21.0.2 - V21.0.2-IF012 and later fixesV21.0.1 - V21.0.1-IF007 and later fixesV20.0.1 - V20.0.3 and later fixesV19.0.1 - V19.0.3 and later fixesV18.0.0 - V18.0.2 and later fixes | |
redhat/golang | <1.19.11 | 1.19.11 |
redhat/golang | <1.20.6 | 1.20.6 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-29406 is a vulnerability in the HTTP/1 client in Golang, which allows a maliciously crafted Host header to inject additional headers or entire requests.
CVE-2023-29406 has a severity value of 6.5, which is considered medium.
CVE-2023-29406 affects Golang Go versions from 1.20.0 up to and including 1.20.6, as well as versions up to and including 1.19.11.
To fix CVE-2023-29406, update to Golang Go version 1.20.7 or 1.19.12 or later.
The references for CVE-2023-29406 are: - https://groups.google.com/g/golang-announce/c/2q13H6LEEx0 - https://go.dev/cl/506996 - https://pkg.go.dev/vuln/GO-2023-1878