GO-2023-1495: golang.org/x/net fixed in 0.1.1-0.20221104162952-702349b0e862 and 0.1.1-0.20221104162952

GO-2023-1495 PUBLISHED

Record from OSV · Published January 13, 2023

golang.org/x/net is fixed in 0.1.1-0.20221104162952-702349b0e862 and 0.1.1-0.20221104162952 (Go Modules)

Request smuggling due to improper request handling in golang.org/x/net/http2/h2c

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
golang.org/x/net	Go Modules	0.1.1-0.20221104162952-702349b0e862, 0.1.1-0.20221104162952

Vendor	Product	Versions
golang.org	x/net	0.0.0-20220524220425-1d687d428aca, 0.0.0-20220524220425-1d687d428aca

The same record, from the CLI:

vulnetix vdb vuln GO-2023-1495
vulnetix vdb fixes GO-2023-1495

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2023-1495/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart