Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2022-1705

Description

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

POC

Reference

No PoCs from references.

Github

- https://github.com/8-cm/kube-dump

- https://github.com/ARPSyndicate/cvemon

- https://github.com/JakubWierzchowski/manier

- https://github.com/agadecki/malware-cryptominer-container

- https://github.com/drewtwitchell/scancompare

- https://github.com/henriquebesing/container-security

- https://github.com/kb5fls/container-security

- https://github.com/ruzickap/malware-cryptominer-container