| packages: |
| - module: std |
| package: net/url |
| symbols: |
| - parseHost |
| - URL.Hostname |
| - URL.Port |
| versions: |
| - fixed: 1.11.13 |
| - introduced: 1.12.0 |
| fixed: 1.12.8 |
| vulnerable_at: 1.12.7 |
| description: | |
| The url.Parse function accepts URLs with malformed hosts, such that the Host |
| field can have arbitrary suffixes that appear in neither Hostname() nor Port(), |
| allowing authorization bypasses in certain applications. |
| cves: |
| - CVE-2019-14809 |
| credit: Julian Hector and Nikolai Krein from Cure53, and Adi Cohen (adico.me) |
| links: |
| pr: https://go.dev/cl/189258 |
| commit: https://go.googlesource.com/go/+/61bb56ad63992a3199acc55b2537c8355ef887b6 |
| context: |
| - https://go.dev/issue/29098 |
| - https://groups.google.com/g/golang-announce/c/65QixT3tcmg |
