Description
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | golang-1.7 | 1.7.4-2+deb9u3 | DLA-2591-1 |
| Debian 9 | golang-1.8 | 1.8.1-1+deb9u3 | DLA-2592-1 |
| Debian 8 | golang | 2:1.3.3-1+deb8u2 | DLA-1749-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | golang-1.8 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | golang-1.6 +1 | No fix yet | — |
| Ubuntu 14.04 LTS | golang-1.10 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | golang +7 | 1.11.5-2.module+el8.0.0+3175+261ae921 | RHSA-2019:1519 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Devtools 2019 | go-toolset-1.11 +3 | 1.11.5-2.el7 | RHSA-2019:1300 |
| Red Hat Devtools 2019 | go-toolset-1.11-golang +6 | 1.11.5-3.el7 | RHSA-2019:1300 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-tensorboard | 2.16.2-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | golang +7 | 1.11.5-2.module+el8.0.0+5230+75360568 | ELSA-2019-1519 |
Advisories 6
- RHSA-2019:1519 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2019:1300 Red Hat Security Advisory: go-toolset-1.11-golang security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-2591-1 golang-1.7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1749-1 golang - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2592-1 golang-1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2019-1519 Moderate: go-toolset:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 30, 2019
References
- https://github.com/golang/go/issues/30794
- 107432 vdb-entry
- [debian-lts-announce] 20190403 [SECURITY] [DLA 1749-1] golang security update mailing-list
- FEDORA-2019-d05bc7e3df vendor-advisory
- RHSA-2019:1300 vendor-advisory
- RHSA-2019:1519 vendor-advisory
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2591-1] golang-1.7 security update mailing-list
- [debian-lts-announce] 20210313 [SECURITY] [DLA 2592-1] golang-1.8 security update mailing-list