Skip to content
OpenAdvisories
Medium ELSA-2016-1538 1 CVE

Moderate: golang security, bug fix, and enhancement update (Oracle Linux 7)

Published Aug 2, 2016 · Updated Aug 2, 2016

Ecosystem: Oracle Linux

Summary

[1.6.3-1]
- Resolves: rhbz#1358278 - CVE-2016-5386

[1.6.2-1]
- rebase to 1.6.2
- Resolves: rhbz#1346331

Fixed packages 6

ReleasePackageFixed in
Oracle Linux · 7 golang 0:1.6.3-1.el7_2.1
Oracle Linux · 7 golang-bin 0:1.6.3-1.el7_2.1
Oracle Linux · 7 golang-docs 0:1.6.3-1.el7_2.1
Oracle Linux · 7 golang-misc 0:1.6.3-1.el7_2.1
Oracle Linux · 7 golang-src 0:1.6.3-1.el7_2.1
Oracle Linux · 7 golang-tests 0:1.6.3-1.el7_2.1

Vulnerabilities 1

  • Unscored —
    CVE-2016-5386

    Improper input validation in net/http and net/http/cgi

    The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow…

    golang stdlib golang-1.6 Ubuntu Azure Linux Go