UBUNTU-CVE-2023-29406

Details

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

Affected Packages(19 packages)

golang-1.10

Ubuntu Pro 14.04 LTSUbuntu 14.04 LTS

Affected versions:

1.10.4-2ubuntu1~14.04.1

golang-1.10

Ubuntu Pro 16.04 LTSUbuntu 16.04 LTS

Affected versions:

1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2

golang-1.10

Ubuntu 18.04 LTSUbuntu Pro 18.04 LTS

Affected versions:

1.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.21.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu1

golang-1.13

Ubuntu 22.04 LTS

Affected versions:

1.13.8-1ubuntu21.13.8-1ubuntu2.22.04.11.13.8-1ubuntu2.22.04.2

golang-1.13

Ubuntu Pro 16.04 LTS

Affected versions:

1.13.8-1ubuntu1~16.04.21.13.8-1ubuntu1~16.04.31.13.8-1ubuntu1~16.04.3+esm21.13.8-1ubuntu1~16.04.3+esm3

golang-1.13

Ubuntu Pro 18.04 LTS

Affected versions:

1.13.8-1ubuntu1~18.04.21.13.8-1ubuntu1~18.04.31.13.8-1ubuntu1~18.04.41.13.8-1ubuntu1~18.04.4+esm1

golang-1.13

Ubuntu Pro 20.04 LTS

Affected versions:

1.13.1-1ubuntu11.13.3-1ubuntu11.13.4-1ubuntu11.13.5-1ubuntu11.13.6-1ubuntu11.13.6-2ubuntu11.13.7-1ubuntu11.13.8-1ubuntu11.13.8-1ubuntu1.11.13.8-1ubuntu1.2

golang-1.14

Ubuntu Pro 20.04 LTS

Affected versions:

1.14-11.14.1-11.14.2-11.14.2-1ubuntu11.14.3-2ubuntu2~20.04.11.14.3-2ubuntu2~20.04.21.14~beta1-11.14~beta1-21.14~rc1-1

golang-1.16

Ubuntu Pro 18.04 LTS

Affected versions:

1.16.2-0ubuntu1~18.04.21.16.2-0ubuntu1~18.04.2+esm1

golang-1.16

Ubuntu Pro 20.04 LTS

Affected versions:

1.16.2-0ubuntu1~20.041.16.2-0ubuntu1~20.04.11.16.2-0ubuntu1~20.04.1+esm1