CVE-2020-26281

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-26281
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26281.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-26281
Aliases
Published
2020-12-21T22:15:13Z
Modified
2024-05-14T07:53:40.439489Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N CVSS Calculator
Summary
[none]
Details

async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body. One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request. Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary. This has been addressed in async-h1 2.3.0 and previous versions have been yanked.

References

Affected packages

Git / github.com/http-rs/async-h1

Affected ranges

Type
GIT
Repo
https://github.com/http-rs/async-h1
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

v1.*

v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.2

v2.*

v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.2.0
v2.2.1