[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+s3sfH-k=1RQtuEqST-2NB7XrEZZv1QYwxNdG6TuDz_A5ruVA@mail.gmail.com>
Date: Wed, 29 Jul 2015 15:15:45 +0000
From: Jason Buberel <jbuberel@...gle.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request - Go net/http library - HTTP smuggling
Hello OSS Security Community,
The Go open source project has received notification of an HTTP request
smuggling vulnerability in the net/http library (
http://golang.org/pkg/net/http/). The vulnerability was identified in the
1.4.2 release version (http://golang.org/dl) and in the 1.5 release branch.
Patches have already been applied to the 1.5 release branch, and will be
ported to the 1.4.2 release branch. We will then create a 1.4.3 release.
We are requesting a CVE ID in order to coordinate updates with
distributions that include binary packages for the Go programming language.
We will also announce and request that all Go programs using the net/http
package that were compiled with version 1.4.2 or earlier be recompiled with
1.4.3 or 1.5 (when released) due to the static linking nature of the Go
toolchain.
Please let me know if you need additional information.
Regards,
Jason Buberel
Product Manager, Go
Google, Inc.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
