Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
History

Sun, 08 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat acm
Redhat multicluster Engine
CPEs cpe:/a:redhat:acm:2.5::el8
cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.1::el8
Vendors & Products Redhat acm
Redhat multicluster Engine

Mon, 19 Aug 2024 22:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.5::el8
cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.1::el8
Vendors & Products Redhat acm
Redhat multicluster Engine

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published: 2022-08-09T20:16:57

Updated: 2024-08-03T00:10:03.918Z

Reserved: 2022-05-13T00:00:00

Link: CVE-2022-1705

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-08-10T20:15:25.353

Modified: 2024-11-21T06:41:17.323

Link: CVE-2022-1705

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-07-12T00:00:00Z

Links: CVE-2022-1705 - Bugzilla