CVE-2023-29406

Aliases:GO-2023-1878BIT-golang-2023-29406RHBA-2024:2274RHBA-2024:3053RHSA-2023:7202DEBIAN-CVE-2023-29406CGA-2659-pfmp-cxvgCGA-26pq-hpr7-6h9hCGA-29pp-hjg2-fq4mCGA-58v4-c3j5-vwxfCGA-5v3r-3mp4-g5cmCGA-68fg-c2hx-w9hmCGA-722w-xcp4-8wh9CGA-7c2q-cfqr-wm97CGA-88rj-v2fp-qp62CGA-8qfr-v85v-jw72CGA-99v8-66m5-cpmhCGA-9xwr-wqf5-499jCGA-h7rj-r6w5-v2cjCGA-hqpc-xmjr-6jxqCGA-hvgg-9qjq-5p25CGA-m9m8-qrwp-9qmrCGA-p98q-7qg6-pq36CGA-q9fx-xqv4-r9h6CGA-v45f-qx8v-g7j7CGA-vjj5-7fp9-vf43CGA-w2pq-69qh-3qhjCGA-x953-j7c9-fwp6CGA-xh27-9vx2-vcf3CGA-xjj5-p769-crr7CGA-946p-8jjx-w4r7CGA-g765-459q-7h69
Advisory lineage Upstream: 0 Downstream: 28
Modified
Published: 11 Jul 2023, 19:23
Last modified:13 Feb 2025, 16:49

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (nvd)
EPSS Score
1.45% LOW
1% probability +1.19%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Jul 2023, 19:23
Published
Vulnerability first disclosed
13 Feb 2025, 16:49
Last Modified
Vulnerability information updated

Description

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 1.45%• Percentile: 72%

Techniques & Countermeasures

  • CWE-436•Interpretation Conflict

    Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Affected Systems

  • chainguard•go-1.20

    < 1.20.6-r0

  • chainguard•go-1.21

    all

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    all

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•kind

    < 0.21.0-r0

  • wolfi•go-1.20

    < 1.20.6-r0

  • wolfi•go-1.21

    all

  • wolfi•katib-earlystopping

    < 0.19.0-r31

  • wolfi•katib-suggestion-goptuna-compat

    all

  • wolfi•katib-suggestion-hyperband

    < 0.19.0-r31

  • wolfi•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • wolfi•katib-suggestion-nas-darts

    < 0.19.0-r31

  • wolfi•katib-suggestion-nas-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • wolfi•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • wolfi•katib-tfevent-metricscollector

    < 0.19.0-r31

  • wolfi•kind

    < 0.21.0-r0

  • debian•golang-1.15

    all

  • debian•golang-1.19

    all

  • go standard library•net/http

    < 1.19.11 | ≥ 1.20.0-0, < 1.20.6

  • golang•go

    < 1.19.11 | ≥ 1.20.0, < 1.20.6

  • Go•stdlib

    ≥ 1.20.0-0, < 1.20.6

  • redhat•aardvark-dns

    < 2:1.0.1-38.module+el8.9.0+20325+b2853e6e

  • redhat•buildah

    < 1:1.24.6-7.module+el8.9.0+20325+b2853e6e

  • redhat•buildah-debuginfo

    < 1:1.24.6-7.module+el8.9.0+20325+b2853e6e

  • redhat•buildah-debugsource

    < 1:1.24.6-7.module+el8.9.0+20325+b2853e6e

  • redhat•buildah-tests

    < 1:1.24.6-7.module+el8.9.0+20325+b2853e6e

  • redhat•buildah-tests-debuginfo

    < 1:1.24.6-7.module+el8.9.0+20325+b2853e6e

  • redhat•cockpit-podman

    < 0:46-1.module+el8.9.0+20325+b2853e6e

  • redhat•conmon

    < 2:2.1.4-2.module+el8.9.0+20325+b2853e6e

  • redhat•conmon-debuginfo

    < 2:2.1.4-2.module+el8.9.0+20325+b2853e6e

  • redhat•conmon-debugsource

    < 2:2.1.4-2.module+el8.9.0+20325+b2853e6e

  • redhat•container-selinux

    < 2:2.205.0-3.module+el8.9.0+20325+b2853e6e

  • redhat•containernetworking-plugins

    < 1:1.1.1-5.module+el8.9.0+20325+b2853e6e

  • redhat•containernetworking-plugins-debuginfo

    < 1:1.1.1-5.module+el8.9.0+20325+b2853e6e

  • redhat•containernetworking-plugins-debugsource

    < 1:1.1.1-5.module+el8.9.0+20325+b2853e6e

  • redhat•containers-common

    < 2:1-38.module+el8.9.0+20325+b2853e6e

  • redhat•crit

    < 0:3.15-3.module+el8.9.0+20325+b2853e6e

  • redhat•criu

    < 0:3.15-3.module+el8.9.0+20325+b2853e6e

  • redhat•criu-debuginfo

    < 0:3.15-3.module+el8.9.0+20325+b2853e6e

  • redhat•criu-debugsource

    < 0:3.15-3.module+el8.9.0+20325+b2853e6e

Showing first 50 affected entries in server-rendered view.

References (22)