CVE-2015-5739

Name	CVE-2015-5739
Description	The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	ELA-379-1
Debian Bugs	795106

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang (PTS)	jessie, jessie (lts)	2:1.3.3-1+deb8u5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang	source	jessie	2:1.3.3-1+deb8u3		ELA-379-1
golang	source	(unstable)	2:1.4.2-4			795106

Notes

[jessie] - golang <no-dsa> (Minor issue)
[wheezy] - golang <no-dsa> (Minor issue)
https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9