Search for vulnerabilities
Vulnerability details: VCID-4ug2-ug11-aaac
Vulnerability ID VCID-4ug2-ug11-aaac
Aliases CVE-2019-14809
Summary net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-285 Improper Authorization
System Score Found at
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
cvssv3.1 7.5 http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-14809.json
epss 0.01094 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01094 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01094 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01228 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01312 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.01818 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.0221 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.02727 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.02727 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.02727 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.02727 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.03744 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
epss 0.04735 https://api.first.org/data/v1/epss?cve=CVE-2019-14809
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2019-14809
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2019-14809
cvssv3.1 7.5 https://seclists.org/bugtraq/2019/Aug/31
generic_textual HIGH https://seclists.org/bugtraq/2019/Aug/31
archlinux Medium https://security.archlinux.org/AVG-1021
cvssv3.1 7.5 https://www.debian.org/security/2019/dsa-4503
generic_textual HIGH https://www.debian.org/security/2019/dsa-4503
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
https://access.redhat.com/errata/RHSA-2019:3433
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-14809.json
https://api.first.org/data/v1/epss?cve=CVE-2019-14809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
https://github.com/golang/go/issues/29098
https://groups.google.com/forum/#%21topic/golang-announce/0uuMm1BwpHE
https://groups.google.com/forum/#%21topic/golang-announce/65QixT3tcmg
https://groups.google.com/forum/#!topic/golang-announce/0uuMm1BwpHE
https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
https://seclists.org/bugtraq/2019/Aug/31
https://www.debian.org/security/2019/dsa-4503
934954 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934954
ASA-201908-15 https://security.archlinux.org/ASA-201908-15
AVG-1021 https://security.archlinux.org/AVG-1021
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2019-14809 https://nvd.nist.gov/vuln/detail/CVE-2019-14809
RHEA-2019:4179 https://bugzilla.redhat.com/show_bug.cgi?id=1743129
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-14809.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2019-14809
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-14809
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://seclists.org/bugtraq/2019/Aug/31
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.debian.org/security/2019/dsa-4503
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.84162
EPSS Score 0.01094
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.