CVE-2019-19240 - Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header

Back Back to CVE browser

MEDIUM

Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header

Published Nov 22, 2019

5.3

MEDIUM

CVSS 3.1

EPSS 1.54%

Description

Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-787

Out-of-bounds Write

CWE-908

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8866
Advisory
https://github.com/embedthis/goahead/issues/289
x_refsource_MISCExploitThird Party Advisory
https://github.com/embedthis/goahead/issues/290
x_refsource_MISCThird Party Advisory
https://github.com/embedthis/goahead/releases/tag/v5.0.1
x_refsource_MISCRelease Notes

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8866		Advisory
https://github.com/embedthis/goahead/issues/289		x_refsource_MISCExploitThird Party Advisory
https://github.com/embedthis/goahead/issues/290		x_refsource_MISCThird Party Advisory
https://github.com/embedthis/goahead/releases/tag/v5.0.1		x_refsource_MISCRelease Notes