CVE-2019-14809

Aliases:GO-2022-0211
Advisory lineage Upstream: 0 Downstream: 12
Modified
Published: 13 Aug 2019, 20:54
Last modified:05 Aug 2024, 00:26

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.0 (nvd)
EPSS Score
2.53% LOW
3% probability -0.05%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

13 Aug 2019, 20:54
Published
Vulnerability first disclosed
05 Aug 2024, 00:26
Last Modified
Vulnerability information updated

Description

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.

CVSS Metrics

  • v3.0•CRITICAL•Score: 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 2.53%• Percentile: 86%

Affected Systems

  • debian•debian_linux

    10.0

  • golang•go

    < 1.11.13 | ≥ 1.12.0, < 1.12.8

  • Go•stdlib

    ≥ 1.12.0-0, < 1.12.8

References (17)