Skip to content
OpenAdvisories
Unscored RHSA-2016:1538 5 CVEs

Red Hat Security Advisory: golang security, bug fix, and enhancement update

Published Sep 15, 2024 · Updated May 13, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::server golang 0:1.6.3-1.el7_2.1
Red Hat · RHEL 7 enterprise_linux:7::server golang-bin 0:1.6.3-1.el7_2.1
Red Hat · RHEL 7 enterprise_linux:7::server golang-docs 0:1.6.3-1.el7_2.1
Red Hat · RHEL 7 enterprise_linux:7::server golang-misc 0:1.6.3-1.el7_2.1
Red Hat · RHEL 7 enterprise_linux:7::server golang-src 0:1.6.3-1.el7_2.1
Red Hat · RHEL 7 enterprise_linux:7::server golang-tests 0:1.6.3-1.el7_2.1

Vulnerabilities 5

  • Unscored —
    CVE-2015-5739

    Request smuggling due to improper header parsing in net/http

    The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead o…

    stdlib gccgo-4.9 Ubuntu Go
  • Unscored —
    CVE-2015-5740

    The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remo…

    gccgo-4.9 Ubuntu
  • Unscored —
    CVE-2015-5741

    The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remo…

    golang gccgo-4.9 Ubuntu Azure Linux
  • Unscored —
    CVE-2016-3959 Public exploit

    Denial of service due to unchecked parameters in crypto/dsa

    The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key t…

    golang stdlib Azure Linux Go
  • Unscored —
    CVE-2016-5386

    Improper input validation in net/http and net/http/cgi

    The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow…

    golang stdlib golang-1.6 Ubuntu Azure Linux Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1346331
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1353798
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1538.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-5739
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1250352
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5739
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5739
  • report
    https://access.redhat.com/security/cve/CVE-2015-5740
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5740
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5740
  • report
    https://access.redhat.com/security/cve/CVE-2015-5741
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5741
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5741
  • report
    https://access.redhat.com/security/cve/CVE-2016-3959
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1324343
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3959
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3959
  • report
    https://access.redhat.com/security/cve/CVE-2016-5386
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5386
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5386