Golang Go CVE-2019-9741 HTTP Response Splitting Vulnerability

Bugtraq ID:	107432
Class:	Input Validation Error
CVE:	CVE-2019-9741
Remote:	Yes
Local:	No
Published:	Mar 13 2019 12:00AM
Updated:	Mar 13 2019 12:00AM
Credit:	GRagdoll
Vulnerable:	Redhat OpenStack Platform Operational Tools 9 Redhat Enterprise Linux OpenStack Platform 8.0.Operational Tools for RH 7 golang Go 1.11.5
Not Vulnerable:

Golang Go CVE-2019-9741 HTTP Response Splitting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Golang Go CVE-2019-9741 HTTP Response Splitting Vulnerability

References:

• net/http: CRLF injection vulnerability #30794 (golang)
  
• net/url, net/http: reject control characters in URLs (golang)
  
• net/url, net/http: relax CTL-in-URL validation to only ASCII CTLs (golang)
  
• Go Homepage (golang)
  
• Bug 1688230 (CVE-2019-9741) - CVE-2019-9741 golang: CRLF injection in net/http (Redhat)
  
• CVE-2019-9741 (Redhat)