GHSA-q89x-f52w-6hj2

Source

https://github.com/advisories/GHSA-q89x-f52w-6hj2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-q89x-f52w-6hj2/GHSA-q89x-f52w-6hj2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q89x-f52w-6hj2

Aliases

Published

2021-08-25T20:43:04Z

Modified

2023-11-08T03:59:16.284067Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Headers containing newline characters can split messages in hyper

Details

Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.

This issue was fixed by replacing all newline characters with a space during serialization of a header value.

Database specific

{
    "nvd_published_at": "2019-08-26T13:15:00Z",
    "cwe_ids": [
        "CWE-93"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-19T21:25:19Z"
}

References

Affected packages

crates.io / hyper

Package

Name: hyper; View open source insights on deps.dev
Purl: pkg:cargo/hyper

Affected ranges

Type: SEMVER
Events: Introduced

0.10.0

Fixed

0.10.2

crates.io / hyper

Package

Name: hyper; View open source insights on deps.dev
Purl: pkg:cargo/hyper

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.18