Bugzilla – Bug 989630
VUL-0: CVE-2015-5739,CVE-2015-5740,CVE-2015-5741: go: HTTP request smuggling in net/http library
Last modified: 2017-06-15 21:34:30 UTC
http://seclists.org/oss-sec/2015/q3/237 Upstream patches: https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9 https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f https://github.com/golang/go/commit/143822585e32449860e624cace9d2e521deee62e References: https://bugzilla.redhat.com/show_bug.cgi?id=1250352 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5741 http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-5741.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5741
As submitted in https://build.opensuse.org/request/show/407624
openSUSE-SU-2016:1894-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 989630 CVE References: CVE-2015-5739,CVE-2015-5740,CVE-2015-5741 Sources used: openSUSE 13.2 (src): go-1.4.3-15.1
... and sles? and leap?
Leap 42.1 is not affected, upstream reports 1.4.x and 1.5.x to be affected while Leap got 1.6.2.
SLE 12 is also not affected as it's already using 1.6.1, for reference: https://build.suse.de/package/show/SUSE:SLE-12:Update/go So I think this issue is resolved?!
werll, there also are packages: go1.5 and go1.4 are they in use and are they affected?
After talking to Marcus Meissner it looks like we can close this issue as resolved.
released