Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http: insufficient sanitization of Host header #60374

Closed
neild opened this issue May 23, 2023 · 23 comments
Closed

net/http: insufficient sanitization of Host header #60374

neild opened this issue May 23, 2023 · 23 comments
Assignees
@neild
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. release-blocker Security
Milestone
Go1.21

Comments

@neild
Copy link
Contributor

neild commented May 23, 2023

The net/http client does not sufficiently sanitize or check the validity of the Request.Host field. A maliciously-crafted Host field can inject request headers or entire new requests into the sent request. For example, setting Request.Host to "hostname\r\nX-Header: oops" adds an X-Header: oops header to the request.

Whether this is a vulnerability or just a bug depends on whether the Request.Host field is expected to be secured against untrusted inputs. We don't document this one way or the other. Exploiting this in practice seems difficult, since it requires requests to be sent using an unsanitized and untrusted Request.Host value, so if this is a vulnerability it seems reasonable to treat it as PUBLIC track. Either way, we should fix it.

This is a continuation of #11206, which reports the same issue but had an incomplete fix.

Thanks to @bartekn for reporting this issue.
@neild neild self-assigned this May 23, 2023
@bcmills bcmills added Security NeedsFix The path to resolution is known, but the work has not been done. labels May 23, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/506995 mentions this issue: http2: validate Host header before sending

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/506996 mentions this issue: net/http: validate Host header before sending

gopherbot pushed a commit to golang/net that referenced this issue Jun 29, 2023
@neild
http2: validate Host header before sending
63727cc 
Verify that the Host header we send is valid.
Avoids sending a request that the server will reject,
possibly sending us into a retry loop.

No test in this CL, but this will be covered by the net/http
test added in CL 506996.

For golang/go#60374

Change-Id: I78867eb05293ad8ca1b02bc22fb626760949d4b8
Reviewed-on: https://go-review.googlesource.com/c/net/+/506995
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
Reviewed-by: Tatiana Bradley <[email protected]>
gopherbot pushed a commit that referenced this issue Jun 29, 2023
@neild
net/http: validate Host header before sending
499458f 
Verify that the Host header we send is valid.
Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops"
adding an X-Evil header to HTTP/1 requests.

Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to
header injection in the way HTTP/1 is, but x/net/http2 doesn't validate
the header and will go into a retry loop when the server rejects it.
CL 506995 adds the necessary validation to x/net/http2.

For #60374

Change-Id: I05cb6866a9bead043101954dfded199258c6dd04
Reviewed-on: https://go-review.googlesource.com/c/go/+/506996
Reviewed-by: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
@neild
Copy link
Contributor Author

neild commented Jun 29, 2023

@gopherbot please open backport issues. This is a (fairly minor) security issue.

This was referenced Jun 29, 2023
Closed
Closed
@gopherbot
Copy link
Contributor

Backport issue(s) opened: #61075 (for 1.19), #61076 (for 1.20).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/507357 mentions this issue: net/http: validate Host header before sending

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/507358 mentions this issue: net/http: validate Host header before sending

@tatianab
Copy link

This is CVE-2023-29406.

@dmitshur dmitshur added this to the Go1.21 milestone Jul 5, 2023
@dmitshur
Copy link
Contributor

dmitshur commented Jul 5, 2023 •
edited
Loading

@neild CL 506995 and CL 506996 both say "For". Is the only thing left to resolve this issue to backport CL 506995 to internal-branch.go1.21-vendor and regenerate src/net/http/h2_bundle.go, or is there more that needs to be done for Go 1.21?

This is being backported to the next 1.20 and 1.19 minor releases, so adding release-blocker here since Go 1.21 shouldn't be released while this issue is still open. (CC @joedian.)

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/507905 mentions this issue: http2: validate Host header before sending

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/507906 mentions this issue: http2: validate Host header before sending

gopherbot pushed a commit that referenced this issue Jul 6, 2023
@neild @joedian
[release-branch.go1.19] net/http: validate Host header before sending
5fa6923 
Verify that the Host header we send is valid.
Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops"
adding an X-Evil header to HTTP/1 requests.

Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to
header injection in the way HTTP/1 is, but x/net/http2 doesn't validate
the header and will go into a retry loop when the server rejects it.
CL 506995 adds the necessary validation to x/net/http2.

Updates #60374
Fixes #61075
For CVE-2023-29406

Change-Id: I05cb6866a9bead043101954dfded199258c6dd04
Reviewed-on: https://go-review.googlesource.com/c/go/+/506996
Reviewed-by: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
(cherry picked from commit 499458f)
Reviewed-on: https://go-review.googlesource.com/c/go/+/507358
Run-TryBot: Tatiana Bradley <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
gopherbot pushed a commit that referenced this issue Jul 6, 2023
@neild @joedian
[release-branch.go1.20] net/http: validate Host header before sending
312920c 
Verify that the Host header we send is valid.
Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops"
adding an X-Evil header to HTTP/1 requests.

Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to
header injection in the way HTTP/1 is, but x/net/http2 doesn't validate
the header and will go into a retry loop when the server rejects it.
CL 506995 adds the necessary validation to x/net/http2.

For #60374
Fixes #61076
For CVE-2023-29406

Change-Id: I05cb6866a9bead043101954dfded199258c6dd04
Reviewed-on: https://go-review.googlesource.com/c/go/+/506996
Reviewed-by: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
(cherry picked from commit 499458f)
Reviewed-on: https://go-review.googlesource.com/c/go/+/507357
Reviewed-by: Damien Neil <[email protected]>
Run-TryBot: Tatiana Bradley <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
@eliben
Copy link
Member

eliben commented Jul 7, 2023

@neild what's the status here?

@neild
Copy link
Contributor Author

neild commented Jul 7, 2023

Only thing left to resolve is the backports, so I think we can close this one.

@neild neild closed this as completed Jul 7, 2023
sluongng added a commit to buildbuddy-io/buildbuddy that referenced this issue Jul 12, 2023
@sluongng
docker: patch host header
01d4773 
In the latest Go version, the net/http client will validate Host header
stricter and will fail if it contains invalid characters.

For more info, see:
- golang/go#60374
- moby/moby#45935

Patch docker temporarily to set Host header to 'localhost' when a UDS
is used.
@tklauser tklauser mentioned this issue Jul 12, 2023
Merged
1 task
@jmurret
Copy link

jmurret commented Jul 14, 2023 •
edited
Loading

Thank you for this change. This does cause an issue for unix sockets that have hostnames starting with a slash. I think we are seeing the community that uses sockets now have to react to this change and put in conditional logic to check their host and if it begins with a slash or ends with .sock change the host name to something like localhost. Is it possible to have this baked into net/http host header validation?

@jmurret jmurret mentioned this issue Jul 14, 2023
Merged
4 tasks
@andresvia
Copy link

Thank you for this change. This does cause an issue for unix sockets that have hostnames starting with a slash. I think we are seeing the community that uses sockets now have to react to this change and put in conditional logic to check their host and if it begins with a slash or ends with .sock change the host name to something like localhost. Is it possible to have this baked into net/http host header validation?

@jmurret I will dare to say that the security fix went too hard and broke a feature which many of us relied on and now there's really no right (clean) way to proceed, if the validation gets baked, workarounds will need to remain because there will be always people running some go release which doesn't have the thing baked. I'm sorry I know I'm not really commenting anything useful, I'll just move on with my life 😄 and let you guys think about what you just did.

bradfitz pushed a commit to tailscale/go that referenced this issue Jul 15, 2023
@neild @bradfitz
net/http: validate Host header before sending
d05f96d 
Verify that the Host header we send is valid.
Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops"
adding an X-Evil header to HTTP/1 requests.

Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to
header injection in the way HTTP/1 is, but x/net/http2 doesn't validate
the header and will go into a retry loop when the server rejects it.
CL 506995 adds the necessary validation to x/net/http2.

For golang#60374

Change-Id: I05cb6866a9bead043101954dfded199258c6dd04
Reviewed-on: https://go-review.googlesource.com/c/go/+/506996
Reviewed-by: Tatiana Bradley <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 27, 2023
@paralin
package/docker-engine: backport fix for host header check
52aa160 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 27, 2023
@paralin
package/docker-cli: backport fix for host header check
240f3af 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 28, 2023
@paralin
package/docker-engine: backport fix for host header check
1bb0f53 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 28, 2023
@paralin
package/docker-cli: backport fix for host header check
0210271 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 28, 2023
@paralin
package/docker-engine: backport fix for host header check
e9ef328 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 28, 2023
@paralin
package/docker-cli: backport fix for host header check
0cb092b 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 28, 2023
@paralin
package/docker-engine: backport fix for host header check
a8d32e7 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
paralin added a commit to skiffos/buildroot that referenced this issue Jul 28, 2023
@paralin
package/docker-cli: backport fix for host header check
455e9e8 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
gopherbot pushed a commit that referenced this issue Aug 7, 2023
@neild
net/http: permit requests with invalid Host headers
b9153f6 
Historically, the Transport has silently truncated invalid
Host headers at the first '/' or ' ' character. CL 506996 changed
this behavior to reject invalid Host headers entirely.
Unfortunately, Docker appears to rely on the previous behavior.

When sending a HTTP/1 request with an invalid Host, send an empty
Host header. This is safer than truncation: If you care about the
Host, then you should get the one you set; if you don't care,
then an empty Host should be fine.

Continue to fully validate Host headers sent to a proxy,
since proxies generally can't productively forward requests
without a Host.

For #60374
Fixes #61431

Change-Id: If170c7dd860aa20eb58fe32990fc93af832742b6
Reviewed-on: https://go-review.googlesource.com/c/go/+/511155
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/518855 mentions this issue: [release-branch.go1.19] net/http: permit requests with invalid Host headers

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/518756 mentions this issue: [release-branch.go1.20] net/http: permit requests with invalid Host headers

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/518856 mentions this issue: [release-branch.go1.21] net/http: permit requests with invalid Host headers

gopherbot pushed a commit that referenced this issue Aug 14, 2023
@neild @gopherbot
[release-branch.go1.21] net/http: permit requests with invalid Host h…
179821c 
…eaders

Historically, the Transport has silently truncated invalid
Host headers at the first '/' or ' ' character. CL 506996 changed
this behavior to reject invalid Host headers entirely.
Unfortunately, Docker appears to rely on the previous behavior.

When sending a HTTP/1 request with an invalid Host, send an empty
Host header. This is safer than truncation: If you care about the
Host, then you should get the one you set; if you don't care,
then an empty Host should be fine.

Continue to fully validate Host headers sent to a proxy,
since proxies generally can't productively forward requests
without a Host.

For #60374
Fixes #61431
Fixes #61904

Change-Id: If170c7dd860aa20eb58fe32990fc93af832742b6
Reviewed-on: https://go-review.googlesource.com/c/go/+/511155
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
(cherry picked from commit b9153f6)
Reviewed-on: https://go-review.googlesource.com/c/go/+/518856
Auto-Submit: Dmitri Shuralyov <[email protected]>
Run-TryBot: Roland Shoemaker <[email protected]>
Reviewed-by: Russ Cox <[email protected]>
gopherbot pushed a commit that referenced this issue Aug 14, 2023
@neild @gopherbot
[release-branch.go1.20] net/http: permit requests with invalid Host h…
ede3e27 
…eaders

Historically, the Transport has silently truncated invalid
Host headers at the first '/' or ' ' character. CL 506996 changed
this behavior to reject invalid Host headers entirely.
Unfortunately, Docker appears to rely on the previous behavior.

When sending a HTTP/1 request with an invalid Host, send an empty
Host header. This is safer than truncation: If you care about the
Host, then you should get the one you set; if you don't care,
then an empty Host should be fine.

Continue to fully validate Host headers sent to a proxy,
since proxies generally can't productively forward requests
without a Host.

For #60374
Fixes #61431
Fixes #61826

Change-Id: If170c7dd860aa20eb58fe32990fc93af832742b6
Reviewed-on: https://go-review.googlesource.com/c/go/+/511155
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
(cherry picked from commit b9153f6)
Reviewed-on: https://go-review.googlesource.com/c/go/+/518756
Auto-Submit: Dmitri Shuralyov <[email protected]>
Reviewed-by: Russ Cox <[email protected]>
Run-TryBot: Roland Shoemaker <[email protected]>
gopherbot pushed a commit that referenced this issue Aug 14, 2023
@neild @gopherbot
[release-branch.go1.19] net/http: permit requests with invalid Host h…
c08a5fa 
…eaders

Historically, the Transport has silently truncated invalid
Host headers at the first '/' or ' ' character. CL 506996 changed
this behavior to reject invalid Host headers entirely.
Unfortunately, Docker appears to rely on the previous behavior.

When sending a HTTP/1 request with an invalid Host, send an empty
Host header. This is safer than truncation: If you care about the
Host, then you should get the one you set; if you don't care,
then an empty Host should be fine.

Continue to fully validate Host headers sent to a proxy,
since proxies generally can't productively forward requests
without a Host.

For #60374
Fixes #61431
Fixes #61825

Change-Id: If170c7dd860aa20eb58fe32990fc93af832742b6
Reviewed-on: https://go-review.googlesource.com/c/go/+/511155
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Run-TryBot: Damien Neil <[email protected]>
(cherry picked from commit b9153f6)
Reviewed-on: https://go-review.googlesource.com/c/go/+/518855
Auto-Submit: Dmitri Shuralyov <[email protected]>
Run-TryBot: Roland Shoemaker <[email protected]>
Reviewed-by: Russ Cox <[email protected]>
ncabatoff pushed a commit to hashicorp/vault that referenced this issue Aug 23, 2023
@hc-github-team-secure-vault-core
The Host part of the URL doesn't actually get used when we initiate c…
77566cc 
…onnections to UNIX domain sockets. As of golang/go#60374 (in the latest Go releases at the time of this writing), we must set it to something that looks like a hostname or requests will fail.
@ncabatoff ncabatoff mentioned this issue Aug 23, 2023
Merged
ncabatoff added a commit to hashicorp/vault that referenced this issue Aug 23, 2023
@ncabatoff
Work around issue with UNIX domain sockets in api.Client addresses (#…
e29d98a 
…22523)

The Host part of the URL doesn't actually get used when we initiate connections to UNIX domain sockets.  As of golang/go#60374 (in the latest Go releases at the time of this writing), we must set it to something that looks like a hostname or requests will fail.
This was referenced Aug 23, 2023
Merged
Merged
Merged
arnout pushed a commit to buildroot/buildroot that referenced this issue Sep 6, 2023
@paralin @jacmet
package/docker-engine: backport fix for host header check
0b608f0 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
Tested-by: TIAN Yuanhao <[email protected]>
Signed-off-by: Peter Korsgaard <[email protected]>
arnout pushed a commit to buildroot/buildroot that referenced this issue Sep 6, 2023
@paralin @jacmet
package/docker-cli: backport fix for host header check
ce1b80f 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
Tested-by: TIAN Yuanhao <[email protected]>
Signed-off-by: Peter Korsgaard <[email protected]>
arnout pushed a commit to buildroot/buildroot that referenced this issue Sep 6, 2023
@paralin @jacmet
package/docker-engine: backport fix for host header check
ff72ac4 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
Tested-by: TIAN Yuanhao <[email protected]>
Signed-off-by: Peter Korsgaard <[email protected]>
arnout pushed a commit to buildroot/buildroot that referenced this issue Sep 6, 2023
@paralin @jacmet
package/docker-cli: backport fix for host header check
d0ab8a8 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
Tested-by: TIAN Yuanhao <[email protected]>
Signed-off-by: Peter Korsgaard <[email protected]>
j1nx pushed a commit to OpenVoiceOS/buildroot that referenced this issue Mar 27, 2024
@paralin @j1nx
package/docker-engine: backport fix for host header check
8beef46 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
Tested-by: TIAN Yuanhao <[email protected]>
Signed-off-by: Peter Korsgaard <[email protected]>
j1nx pushed a commit to OpenVoiceOS/buildroot that referenced this issue Mar 27, 2024
@paralin @j1nx
package/docker-cli: backport fix for host header check
2b756f0 
Go 1.20.6 and 1.19.11 include a security check of the http Host header:

  golang/go#60374

docker-cli does not satisfy this check:

  $ docker exec -it ctr bash
  http: invalid Host header

This is a backported patch to fix this issue:

Issue: moby/moby#45935
Upstream PR: moby/moby#45942

The upstream PR has been merged and will be included in v24.0.5.

Signed-off-by: Christian Stewart <[email protected]>
Tested-by: TIAN Yuanhao <[email protected]>
Signed-off-by: Peter Korsgaard <[email protected]>
@jmurret jmurret mentioned this issue May 28, 2024
Closed
4 tasks
@golang golang locked and limited conversation to collaborators Aug 10, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@neild neild

Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. release-blocker Security
Projects
None yet
Milestone
Go1.21
Development

No branches or pull requests