|Type||Url request injection|
A security issue has been found in Go before version 1.16.5. ReverseProxy in net/http/httputil could be made to forward certain hop-by-hop headers, including Connection. In case the target of the ReverseProxy was itself a reverse proxy, this would let an attacker drop arbitrary headers, including those set by the ReverseProxy.Director.
|15 Jun 2021||ASA-202106-42||AVG-2006||go||Medium||multiple issues|