CVE-2019-14809 Auth bypass in n/a
Attackers can bypass authorization checks in Go applications by crafting URLs with malformed hosts that confuse hostname parsing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14809?
CVE-2019-14809 is a critical authentication bypass vulnerability in Debian Debian Linux, published on 13 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
Which versions are affected by CVE-2019-14809?
1 open source package ship an affected version, including stdlib. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
stdlib Go | All versions | 1.11.13, 1.12.8 |
Linux distribution packages (18)
go-toolset-1.12 Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-build Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-golang Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-bin Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-docs Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-misc Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-race Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-src Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-tests Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset-1.12-runtime Red Hat:devtools:2019 | All versions | 0:1.12.8-2.el7 |
go-toolset Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-1.module+el8.1.0+4089+be929cf8 |
golang Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-bin Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-docs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-misc Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-race Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-src Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-tests Red Hat:enterprise_linux:8::appstream | All versions | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
Products include Debian Debian Linux, Golang Go.
How do I fix CVE-2019-14809?
Upgrade stdlib to a fixed version for your release line: 1.11.13 or 1.12.8.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-14809 being exploited?
There is no known exploitation of CVE-2019-14809 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-78948, AZL-98907, GHSA-2xf8-4fv6-m993, GO-2022-0211, RHEA-2019:4179, RHSA-2019:3433 and 1 more.