CVE-2019-9741 Other in n/a
Attackers can inject CRLF sequences into HTTP requests via URL parameters, potentially leading to header injection or command execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-9741?
CVE-2019-9741 is a medium-severity vulnerability in Debian Debian Linux, published on 13 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.
Weakness: CWE-93
Which versions are affected by CVE-2019-9741?
It affects 5 products.
Linux distribution packages (19)
go-toolset-1.11 Red Hat:devtools:2019 | All versions | 0:1.11.5-2.el7 |
go-toolset-1.11-build Red Hat:devtools:2019 | All versions | 0:1.11.5-2.el7 |
go-toolset-1.11-golang Red Hat:devtools:2019 | All versions | 0:1.11.5-3.el7 |
go-toolset-1.11-golang-bin Red Hat:devtools:2019 | All versions | 0:1.11.5-3.el7 |
go-toolset-1.11-golang-docs Red Hat:devtools:2019 | All versions | 0:1.11.5-3.el7 |
go-toolset-1.11-golang-misc Red Hat:devtools:2019 | All versions | 0:1.11.5-3.el7 |
go-toolset-1.11-golang-race Red Hat:devtools:2019 | All versions | 0:1.11.5-3.el7 |
go-toolset-1.11-golang-src Red Hat:devtools:2019 | All versions | 0:1.11.5-3.el7 |
go-toolset-1.11-golang-tests Red Hat:devtools:2019 | All versions | 0:1.11.5-3.el7 |
go-toolset-1.11-runtime Red Hat:devtools:2019 | All versions | 0:1.11.5-2.el7 |
go-toolset-1.11-scldevel Red Hat:devtools:2019 | All versions | 0:1.11.5-2.el7 |
go-toolset Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
golang Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
golang-bin Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
golang-docs Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
golang-misc Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
golang-race Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
golang-src Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
golang-tests Red Hat:enterprise_linux:8::appstream | All versions | 0:1.11.5-2.module+el8.0.0+3175+261ae921 |
Products include Debian Debian Linux, Fedoraproject Fedora, Golang Go, Redhat Developer Tools, Redhat Enterprise Linux.
How do I fix CVE-2019-9741?
Upgrade to a fixed version.
Is CVE-2019-9741 being exploited?
There is no known exploitation of CVE-2019-9741 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-38599, DLA-1749-1, GHSA-46v6-2c7g-7hfg, RHSA-2019:1300, RHSA-2019:1519, UBUNTU-CVE-2019-9741.