Google Go HTTP Request Smuggling Multiple Vulnerabilities
Description
(#Several HTTP request smuggling vulnerabilities have been identified in Google's Go language:#- CVE-2015-5739: syntactically invalid headers are parsed as valid and don't provoke a 400 HTTP error#- CVE-2015-5740: double 'Content-length' header fields don't provoke a 400 HTTP error and the second field is ignored#- CVE-2015-5741: sending a 'Content-length' header field in some messages with a 'Transfer-Encoding' field don't provoke a 400 HTTP error##A remote attacker can potentially use the fact that these requests are not correctly handled to bypass some security measures, do cache poisoning or alter some requests to provoke a denial of service.##Updated, 05/08/2015:#The golang packages provided by Debian Wheezy 7 and Jessie 8 are impacted.#Updated, 25/08/2015:#The go and go14 packages provided by FreeBSD are vulnerable.)
