net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2019-08-13T20:54:24
Updated: 2024-08-05T00:26:39.120Z
Reserved: 2019-08-10T00:00:00
Link: CVE-2019-14809
Vulnrichment
No data.
NVD
Status : Modified
Published: 2019-08-13T21:15:11.427
Modified: 2024-11-21T04:27:24.180
Link: CVE-2019-14809
Redhat