CVE-2021-32643

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-32643
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32643.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-32643
Aliases
Published
2021-05-27T18:15:07Z
Modified
2026-10-20T10:54:41Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns F[None], indicating no resource, if url.getFile is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The patch is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling StaticFile.fromUrl with non-file URLs.

References

Affected packages

Git / github.com/http4s/http4s

Affected ranges

Type
GIT
Repo
https://github.com/http4s/http4s
Events
Introduced
6ad94f6ffeda3644321d85fcaf82d666d996e87a
Fixed
2d2e26171bfc2881ea4b00c42c463d801c777db0
Introduced
c56f915bd81c2fe19dcb04e32ad39c3972fac2e1
Last Affected
6676c1e24a4e32e0c6c1a36911f4e6606c10e12b
Fixed
52e1890665410b4385e37b96bc49c5e3c708e4e9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.21.7"
                },
                {
                    "fixed":  "0.21.24"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone1"
                },
                {
                    "last_affected":  "0.22.0-milestone1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone2"
                },
                {
                    "last_affected":  "0.22.0-milestone2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone3"
                },
                {
                    "last_affected":  "0.22.0-milestone3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone4"
                },
                {
                    "last_affected":  "0.22.0-milestone4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone5:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone5"
                },
                {
                    "last_affected":  "0.22.0-milestone5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone6:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone6"
                },
                {
                    "last_affected":  "0.22.0-milestone6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone7:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone7"
                },
                {
                    "last_affected":  "0.22.0-milestone7"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.22.0:milestone8:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.22.0-milestone8"
                },
                {
                    "last_affected":  "0.22.0-milestone8"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:0.23.0:milestone1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0.23.0-milestone1"
                },
                {
                    "last_affected":  "0.23.0-milestone1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone1"
                },
                {
                    "last_affected":  "1.0.0-milestone1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone10"
                },
                {
                    "last_affected":  "1.0.0-milestone10"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone11"
                },
                {
                    "last_affected":  "1.0.0-milestone11"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone12"
                },
                {
                    "last_affected":  "1.0.0-milestone12"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone13"
                },
                {
                    "last_affected":  "1.0.0-milestone13"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone14"
                },
                {
                    "last_affected":  "1.0.0-milestone14"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone15"
                },
                {
                    "last_affected":  "1.0.0-milestone15"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone16"
                },
                {
                    "last_affected":  "1.0.0-milestone16"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone17"
                },
                {
                    "last_affected":  "1.0.0-milestone17"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone18"
                },
                {
                    "last_affected":  "1.0.0-milestone18"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone19"
                },
                {
                    "last_affected":  "1.0.0-milestone19"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone2"
                },
                {
                    "last_affected":  "1.0.0-milestone2"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone20"
                },
                {
                    "last_affected":  "1.0.0-milestone20"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone21"
                },
                {
                    "last_affected":  "1.0.0-milestone21"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone22"
                },
                {
                    "last_affected":  "1.0.0-milestone22"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone3"
                },
                {
                    "last_affected":  "1.0.0-milestone3"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone4"
                },
                {
                    "last_affected":  "1.0.0-milestone4"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone5"
                },
                {
                    "last_affected":  "1.0.0-milestone5"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone6"
                },
                {
                    "last_affected":  "1.0.0-milestone6"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone7"
                },
                {
                    "last_affected":  "1.0.0-milestone7"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone8"
                },
                {
                    "last_affected":  "1.0.0-milestone8"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0-milestone9"
                },
                {
                    "last_affected":  "1.0.0-milestone9"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "52e1890665410b4385e37b96bc49c5e3c708e4e9"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.22.0-milestone1
0.22.0-milestone2
0.22.0-milestone3
0.22.0-milestone4
0.22.0-milestone5
0.22.0-milestone6
0.22.0-milestone7
0.22.0-milestone8
0.23.0-milestone1
1.*
1.0.0-milestone1
1.0.0-milestone10
1.0.0-milestone11
1.0.0-milestone12
1.0.0-milestone13
1.0.0-milestone14
1.0.0-milestone15
1.0.0-milestone16
1.0.0-milestone17
1.0.0-milestone18
1.0.0-milestone19
1.0.0-milestone2
1.0.0-milestone20
1.0.0-milestone21
1.0.0-milestone22
1.0.0-milestone3
1.0.0-milestone4
1.0.0-milestone5
1.0.0-milestone6
1.0.0-milestone7
1.0.0-milestone8
1.0.0-milestone9
v0.*
v0.21.11
v0.21.12
v0.21.13
v0.21.14
v0.21.15
v0.21.16
v0.21.18
v0.21.19
v0.21.20
v0.21.21
v0.21.22
v0.21.23
v0.21.7
v0.21.8
v0.21.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32643.json"