VDB
RHSA-2020%3A0652
RHSA-2020%3A0652
PUBLISHED
CVSS 6.5 MEDIUM
Record from redhat · Published March 5, 2020
It was discovered that net/http (through net/textproto) in golang does not correctly interpret HTTP requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or to filter bypasses depending on the specific network configuration.
Risk scores
CVSS 3.0
6.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-installer@sha256:c7d9b92f07e455467d99a90402026873b11716073820365ddf2408419e1aeff4_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | openshift4/ose-installer-artifacts@sha256:59830f36fe5430560e979f4628c47f18e2b3a4dcf7d6480ea1cece126a147bf5_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | openshift4/ose-installer-artifacts@sha256:59830f36fe5430560e979f4628c47f18e2b3a4dcf7d6480ea1cece126a147bf5_amd64 |
| Red Hat | openshift4/ose-installer@sha256:10542c71ffb400b3fb5eb760ff89cf214f43f40782352e7ecfa4cbf26566704a_s390x as a component of Red Hat OpenShift Container Platform 4.2 | openshift4/ose-installer@sha256:10542c71ffb400b3fb5eb760ff89cf214f43f40782352e7ecfa4cbf26566704a_s390x |
| Red Hat | openshift4/ose-installer-artifacts@sha256:41c8e72f58cdff8d65219d0da45ef381cc7b6db50e702edc9ee9cd4b662db05b_s390x as a component of Red Hat OpenShift Container Platform 4.2 | openshift4/ose-installer-artifacts@sha256:41c8e72f58cdff8d65219d0da45ef381cc7b6db50e702edc9ee9cd4b662db05b_s390x |
Timeline
- Mar 5, 2020 CVE Published
- Feb 26, 2026 CVE Updated
- Apr 30, 2026 Distribution Patch (2 in total, the first dated here)
- Apr 30, 2026 Security Advisory (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2020%3A0652
vulnetix vdb fixes RHSA-2020%3A0652Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2020%253A0652/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2020:0652 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1755969 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0652.json advisory
- https://access.redhat.com/security/cve/CVE-2019-16276 advisory
- https://www.cve.org/CVERecord?id=CVE-2019-16276 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-16276 advisory
- https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ advisory