Amazon Linux AMI Security Advisory: ALAS-2019-1238
Advisory Release Date: 2019-07-17 23:28 Pacific
Advisory Updated Date: 2019-07-25 18:38 Pacific
An issue was discovered in net/http in Go. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command. (CVE-2019-9741)
Run yum update golang to update your system.