8.1high
CVE-2016-5386
Improper input validation in net/http and net/http/cgi
Also known as GO-2022-0761
Published 10 y ago · modified 4 mo ago · JSON
CVSS
8.1
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
5.2%
percentile 93%
Public exploits
0
none known
Summary
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Exploit prediction (EPSS)
5.22% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | stdlib | <1.6.3 | 1.6.3 |
Classification
- Weakness
- CWE-284 Improper Access Control
References
- kb.cert.org /vuls/id/797896 · third-party-advisory, x_refsource_CERT-VN, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=1353798 · x_refsource_CONFIRM, x_transferred
- oracle.com /technetwork/topics/security/linuxbulletinjul2016-3090544.html · x_refsource_CONFIRM, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/7WGHKKCFP4PLVSWQKCM3FJJP · vendor-advisory, x_refsource_FEDORA, x_transferred
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/OR52UXGM6RKSCWF3KQMVZGVZ · vendor-advisory, x_refsource_FEDORA, x_transferred
- rhn.redhat.com /errata/RHSA-2016-1538.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us · x_refsource_CONFIRM, x_transferred
- httpoxy.org / · x_refsource_MISC, x_transferred
- oracle.com /technetwork/security-advisory/cpujul2017-3236622.html · x_refsource_CONFIRM, x_transferred
- go.dev /cl/25010 · fix
- go.googlesource.com /go/+/b97df54c31d6c4cc2a28a3c83725366d52329223 · fix
- go.dev /issue/16405 · report
- groups.google.com /g/golang-announce/c/7jZDOQ8f8tM/m/eWRWHnc8CgAJ · web
Sources
- CVE List: CVE-2016-5386
- NVD: CVE-2016-5386
- OSV: GO-2022-0761
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.