漏洞等级： 
漏洞信息
An input-validation flaw was discovered in the Go programming language built in CGI implementation, which set the environment variable "HTTP_PROXY" using the incoming "Proxy" HTTP-request header. The environment variable "HTTP_PROXY" is used by numerous web clients, including Go's net/http package, to specify a proxy server to use for HTTP and, in some cases, HTTPS requests. This meant that when a CGI-based web application ran, an attacker could specify a proxy server which the application then used for subsequent outgoing requests, allowing a man-in-the-middle attack.
漏洞危害
Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.
解决方案
Please refer to Amazon advisory ALAS-2016-731 for affected packages and patching details, or update with your package manager.
Patch:
Following are links for downloading patches to fix the vulnerabilities:
ALAS-2016-731: Amazon Linux (golang (1.5.3-1.22.amzn1) on noarch)
ALAS-2016-731: Amazon Linux (golang (1.5.3-1.22.amzn1) on x86_64)
ALAS-2016-731: Amazon Linux (golang (1.5.3-1.22.amzn1) on src)
ALAS-2016-731: Amazon Linux (golang (1.5.3-1.22.amzn1) on i686)
0day
文章评论