CRLF injection in Go programming language - CVE-2019-9741

Vulnerability identifier: #VU36076

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9741

CWE-ID: CWE-93

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with followed by an HTTP header or a Redis command.

Go programming language
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Fedora
go-toolset-1.11 (Red Hat package)
go-toolset-1.11-golang (Red Hat package)
golang

Install update from vendor's website.

go-toolset-1.11 (Red Hat package) - update to 1.11.5-2.el7
go-toolset-1.11-golang (Red Hat package) - update to 1.11.5-3.el7
golang - update to 1.11.6-1.fc29

• http://www.securityfocus.com/bid/107432
• https://access.redhat.com/errata/RHSA-2019:1300
• https://access.redhat.com/errata/RHSA-2019:1519
• https://github.com/golang/go/issues/30794
• https://lists.debian.org/debian-lts-announce/2019/04/msg00007.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TOOVCEPQM7TZA6VEZEEB7QZABXNHQEHH/

• CRLF injection in GOland Go fro del
• Amazon Linux AMI update for golang
• Red Hat Developer Tools update for go-toolset-1.11 and go-toolset-1.11-golang
• Fedora 29 update for golang
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module