Vulnerability GHSA-q89x-f52w-6hj2
Medium Risk
MEDIUM RISK
CVSS Score: 5.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
5 years ago
August 25, 2021 at 08:43 PM UTC
Headers containing newline characters can split messages in hyper
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1
Summary
Headers containing newline characters can split messages in hyper
Details
Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.
This issue was fixed by replacing all newline characters with a space during serialization of a header value.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
Unknown
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
Medium Risk
5 years ago
HTTP Request Smuggling in hyper
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
Critical
5 years ago
HTTP Request Smuggling in hyper
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
Medium Risk
5 years ago
HTTPS MitM vulnerability due to lack of hostname verification
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
0.0.1 - 0.9.3 GHSA-9xjr-m6f3-v5wm
Impacted packages
Timeline
Published
5 years ago
August 25, 2021 at 08:43 PM UTC
Fixed (0.10.2)
9 years ago
January 23, 2017 at 07:47 PM UTC
Fixed (0.9.18)
9 years ago
January 30, 2017 at 06:12 PM UTC
Last Modified
2 years ago
November 08, 2023 at 03:59 AM UTC