Search for packages
| purl | pkg:deb/debian/golang-1.20@1.20.5-1 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 3.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2x5k-kja4-aaac
Aliases: CVE-2023-29406 |
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2024-01-12T12:56:25.637929+00:00 | Debian Importer | Affected by | VCID-2x5k-kja4-aaac | None | 34.0.0rc2 |
| 2024-01-05T08:37:50.178006+00:00 | Debian Importer | Affected by | VCID-2x5k-kja4-aaac | None | 34.0.0rc1 |