AZL-98907

    Dashboard / Vulnerabilities / AZL-98907

    AZL-98907

    Published: 13 Aug 2019Last Modified: 10 Sept 2026
    Upstream:
    CVE-2019-14809

    Summary: CVE-2019-14809 affecting package golang 1.27.1-1

    Details: net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.

    References: https://nvd.nist.gov/vuln/detail/CVE-2019-14809

    Affected packages

    Package

    Name: golang

    Purl: pkg:rpm/azure-linux/golang

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 1.27.0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High