CVE catalog
CVE-2016-5386
go-1.17-1.1 on GA media
- Severity
- High · CVSS 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 5.22% · Oct 25, 2026
go1.4 was updated to fix the following vulnerabilities: - CVE-2016-5386: Remote attacker could have set the application's HTTP_PROXY environment variable via Proxy headers (boo#988487)
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Suse | go1.4 | package hub 12 | 1.4.3-6.1 | fixed |
| Suse | go | package hub 12 | 1.6.1-6.1 | fixed |
| Opensuse | go1.11 | tumbleweed | 1.11.13-10.5 | fixed |
| Suse | go | package hub 12 | 1.6.1-6.1 | fixed |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu1 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu2 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu3 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu4 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6-0ubuntu5 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.1-0ubuntu1 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.2 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.3 | vulnerable |
| Ubuntu | golang-1.6 | 16.04 | 1.6.2-0ubuntu5~16.04.4 | vulnerable |
| Opensuse | go | tumbleweed | 1.17-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Suse | go1.4 | rpm | package hub 12 | 1.4.3-6.1 | Not reported | OPENSUSE-SU-2016:2536-1 | Not reported |
| Suse | go | rpm | package hub 12 | 1.6.1-6.1 | Not reported | OPENSUSE-SU-2016:2055-1 | Not reported |
| Opensuse | go1.11 | rpm | tumbleweed | 1.11.13-10.5 | Not reported | OPENSUSE-SU-2024:10804-1 | Not reported |
| Suse | go | rpm | package hub 12 | 1.6.1-6.1 | Not reported | OPENSUSE-SU-2016:2054-1 | Not reported |
| Opensuse | go | rpm | tumbleweed | 1.17-1.1 | Not reported | OPENSUSE-SU-2024:10802-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [go-doc]Unknown
Source package: [go]
Details (1)
1.27-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.17-1.1Version impact unknown
pypi · go · opensuse · tumbleweed
- [go-race]Unknown
Source package: [go]
Details (1)
1.27-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.17-1.1Version impact unknown
pypi · go · opensuse · tumbleweed
- [go]Fixed
Source package: [go]
Details (1)
1.27-1.1· x86_64 · tumbleweedFixed · Fixed:
1.17-1.1pypi · go · opensuse · tumbleweed
Observed:
References
- [https://access.redhat.com/errata/RHSA-2016:1538]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2016_1538.json]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2016-5386]
- [https://osv.dev/vulnerability/openSUSE-SU-2016:2054-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2016:2055-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2016:2536-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:10802-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:10804-1]
[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]