CVE-2019-16276 Other in n/a
An HTTP Request Smuggling vulnerability in the Go standard library allows attackers to bypass security controls or poison caches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-16276?
CVE-2019-16276 is a high-severity vulnerability in Debian Debian Linux, published on 30 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
Weakness: CWE-444
Which versions are affected by CVE-2019-16276?
1 open source package ship an affected version, including stdlib. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
stdlib Go | All versions | 1.12.10, 1.13.1 |
Linux distribution packages (12)
atomic-enterprise-service-catalog Red Hat:openshift:4.2::el7 | All versions | 1:4.2.4-201911041319.git.1.1de4bcd.el7 |
atomic-enterprise-service-catalog-svcat Red Hat:openshift:4.2::el7 | All versions | 1:4.2.4-201911041319.git.1.1de4bcd.el7 |
atomic-openshift-service-idler Red Hat:openshift:4.2::el7 | All versions | 0:4.2.4-201911041319.git.1.4131c2f.el7 |
openshift Red Hat:openshift:4.2::el7 | All versions | 0:4.2.4-201911041319.git.0.c7d2111.el7 |
openshift-clients Red Hat:openshift:4.2::el7 | All versions | 0:4.2.4-201911010432.git.1.30c33a5.el7 |
openshift-clients-redistributable Red Hat:openshift:4.2::el7 | All versions | 0:4.2.4-201911010432.git.1.30c33a5.el7 |
openshift-enterprise-autoheal Red Hat:openshift:4.2::el7 | All versions | 0:4.2.4-201911010432.git.1.0b5cd44.el7 |
openshift-hyperkube Red Hat:openshift:4.2::el7 | All versions | 0:4.2.4-201911041319.git.0.c7d2111.el7 |
openshift Red Hat:openshift:4.2::el8 | All versions | 0:4.2.4-201911041319.git.0.c7d2111.el8 |
openshift-clients Red Hat:openshift:4.2::el8 | All versions | 0:4.2.4-201911010432.git.1.30c33a5.el8 |
openshift-clients-redistributable Red Hat:openshift:4.2::el8 | All versions | 0:4.2.4-201911010432.git.1.30c33a5.el8 |
openshift-hyperkube Red Hat:openshift:4.2::el8 | All versions | 0:4.2.4-201911041319.git.0.c7d2111.el8 |
Products include Debian Debian Linux, Fedoraproject Fedora, Golang Go, Netapp Cloud Insights Telegraf Agent, Opensuse Leap, Redhat Developer Tools and 3 more.
How do I fix CVE-2019-16276?
Upgrade stdlib to a fixed version for your release line: 1.12.10 or 1.13.1.
Is CVE-2019-16276 being exploited?
There is no known exploitation of CVE-2019-16276 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DSA-4534-1, GHSA-xv7j-jr8q-mhmm, GO-2022-0212, RHBA-2019:3304, UBUNTU-CVE-2019-16276.