GHSA-3892-2r52-p65m

Source

https://github.com/advisories/GHSA-3892-2r52-p65m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-3892-2r52-p65m/GHSA-3892-2r52-p65m.json

Aliases

• CVE-2020-7671
• SNYK-RUBY-GOLIATH-569136

Published

2021-05-24T18:20:07Z

Modified

2023-11-08T04:04:03.855869Z

Details

goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-7671
• https://github.com/postrank-labs/goliath/issues/351
• https://github.com/postrank-labs/goliath
• https://snyk.io/vuln/SNYK-RUBY-GOLIATH-569136