Bug 988487 (CVE-2016-5386) - VUL-1: CVE-2016-5386: go: Setting HTTP_PROXY environment variable via Proxy header (httpoxy)
Summary: VUL-1: CVE-2016-5386: go: Setting HTTP_PROXY environment variable via Proxy h...
Status: RESOLVED FIXED
Alias: CVE-2016-5386
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:NVD:CVE-2016-5386:6.8:(AV:N/A...
Keywords:
Depends on:
Blocks: httpoxy
  Show dependency treegraph
 
Reported: 2016-07-12 06:58 UTC by Andreas Stieger
Modified: 2019-10-17 14:26 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Swamp Workflow Management 2016-07-12 22:00:54 UTC
bugbot adjusting priority
Comment 2 Andreas Stieger 2016-07-14 12:50:39 UTC
The vulnerable code seems to be:

src/net/http/cgi/host.go :: ServeHTTP()

> 	for k, v := range req.Header {
> 		k = strings.Map(upperCaseAndUnderscore, k)
> 		joinStr := ", "
> 		if k == "COOKIE" {
> 			joinStr = "; "
> 		}
> 		env = append(env, "HTTP_"+k+"="+strings.Join(v, joinStr))
> 	}

Should skip "Proxy" headers (case-insensitive).
Comment 3 Andreas Stieger 2016-07-14 13:06:26 UTC
Affected in openSUSE.

Not shipped in SLE. However due to the static linking there might be use CGI use case. Should be fixed with the next available update.
Comment 4 Andreas Stieger 2016-07-18 14:16:28 UTC
Public at https://httpoxy.org/

Go

    Go code must be deployed under CGI to be vulnerable. Usually, that’ll mean the vulnerable code uses the net/http/cgi package.
        As with Python, this is not considered a usual way of deploying Go as a web application, so this vulnerability should be relatively rare
        Go’s net/http/fcgi package, by comparison, does not set actual environment variables, so it is not vulnerable
    Vulnerable versions of net/http will trust and use HTTP_PROXY for outgoing requests, without checking if CGI is in use
Comment 5 Jordi Massaguer 2016-07-26 14:51:37 UTC
Issue upstream (go):

https://github.com/golang/go/issues/16405

Commit that fixes it for 1.6:
https://github.com/golang/go/commit/a357d15e9ee36a1232ae071d9968c4cf10a672b4

This commit is included in 1.6.3 release

https://github.com/golang/go/releases/tag/go1.6.3
Comment 8 Jordi Massaguer 2016-07-26 15:07:37 UTC
Affected packages in openSUSE:

openSUSE:13.2:Update (go1.4)
openSUSE:Leap:42.1 (go 1.6.1)
openSUSE:Factory (=Tumbleweed) (go1.6.2)
devel:langauges:go (go1.6.2)
Comment 9 Jordi Massaguer 2016-07-26 15:07:59 UTC
reproducer https://github.com/httpoxy/go-httpoxy-poc
Comment 14 Bernhard Wiedemann 2016-07-26 18:00:23 UTC
This is an autogenerated message for OBS integration:
This bug (988487) was mentioned in
https://build.opensuse.org/request/show/415286 42.1 / go
Comment 16 Bernhard Wiedemann 2016-08-05 20:00:32 UTC
This is an autogenerated message for OBS integration:
This bug (988487) was mentioned in
https://build.opensuse.org/request/show/417181 13.2+42.1+Backports:SLE-12 / go
Comment 18 Swamp Workflow Management 2016-08-11 22:08:41 UTC
openSUSE-SU-2016:2054-1: An update that fixes one vulnerability is now available.

Category: security (low)
Bug References: 988487
CVE References: CVE-2016-5386
Sources used:
SUSE Package Hub for SUSE Linux Enterprise 12 (src):    go-1.6.1-6.1
Comment 19 Swamp Workflow Management 2016-08-11 22:08:58 UTC
openSUSE-SU-2016:2055-1: An update that fixes one vulnerability is now available.

Category: security (low)
Bug References: 988487
CVE References: CVE-2016-5386
Sources used:
openSUSE Leap 42.1 (src):    go-1.6.2-21.1
openSUSE 13.2 (src):    go-1.4.3-18.1
Comment 20 Swamp Workflow Management 2016-10-14 13:08:57 UTC
openSUSE-SU-2016:2536-1: An update that fixes one vulnerability is now available.

Category: security (low)
Bug References: 988487
CVE References: CVE-2016-5386
Sources used:
SUSE Package Hub for SUSE Linux Enterprise 12 (src):    go1.4-1.4.3-6.1
Comment 21 Marcus Meissner 2017-06-15 21:34:19 UTC
released, or at least go internally upgraded and dependend programs will be queued
Comment 22 Swamp Workflow Management 2018-05-17 17:02:03 UTC
This is an autogenerated message for OBS integration:
This bug (988487) was mentioned in
https://build.opensuse.org/request/show/610123 Factory / go1.10
Comment 30 Swamp Workflow Management 2018-12-15 08:42:45 UTC
This is an autogenerated message for OBS integration:
This bug (988487) was mentioned in
https://build.opensuse.org/request/show/658307 Factory / go1.10
https://build.opensuse.org/request/show/658308 Factory / go1.11
Comment 32 Swamp Workflow Management 2018-12-17 15:44:08 UTC
This is an autogenerated message for OBS integration:
This bug (988487) was mentioned in
https://build.opensuse.org/request/show/658934 15.0+42.3 / go1.11
Comment 33 Swamp Workflow Management 2019-02-27 11:03:07 UTC
This is an autogenerated message for OBS integration:
This bug (988487) was mentioned in
https://build.opensuse.org/request/show/679777 Factory / go1.11
Comment 34 Swamp Workflow Management 2019-03-25 11:13:45 UTC
This is an autogenerated message for OBS integration:
This bug (988487) was mentioned in
https://build.opensuse.org/request/show/688187 Factory / go1.12