Skip to content

net/http: invalid headers are normalized, allowing request smuggling #34540

Closed
@FiloSottile

Description

@FiloSottile

net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind a reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications.

This issue is CVE-2019-16276 and is fixed in Go 1.13.1 and Go 1.12.10.

Activity

added
NeedsFixThe path to resolution is known, but the work has not been done.
on Sep 25, 2019
added this to the Go1.14 milestone on Sep 25, 2019
self-assigned this
on Sep 25, 2019
FiloSottile

FiloSottile commented on Sep 25, 2019

@FiloSottile
ContributorAuthor

@gopherbot Please open backport issues for this. This was a security problem.

gopherbot

gopherbot commented on Sep 25, 2019

@gopherbot
Contributor

Backport issue(s) opened: #34541 (for 1.12), #34542 (for 1.13).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://golang.org/wiki/MinorReleases.

added a commit that references this issue on Sep 26, 2019
added a commit that references this issue on Sep 26, 2019
thaJeztah

thaJeztah commented on Sep 26, 2019

@thaJeztah
Contributor

Looks like this fix is not in master, only in the release branches, correct?

32 remaining items

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FrozenDueToAgeNeedsFixThe path to resolution is known, but the work has not been done.Security

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @sporkmonger@FiloSottile@thausler786@thaJeztah@gopherbot

        Issue actions

          net/http: invalid headers are normalized, allowing request smuggling · Issue #34540 · golang/go