CVE-2021-41084 (GCVE-0-2021-41084)

Vulnerability from cvelistv5 – Published: 2021-09-21 17:20 – Updated: 2024-08-04 02:59
VLAI?
Summary
http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`å), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.
Severity ?
8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
Impacted products
Vendor Product Version
http4s http4s Affected: <= 0.21.28
Affected: >= 0.22.0, < 0.22.5
Affected: >= 0.23.0, < 0.23.4
Affected: >= 1.0.0-M1, < 1.0.0-M27
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T02:59:31.504Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "http4s",
          "vendor": "http4s",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.21.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M27"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`\u00e5), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-21T17:20:14",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting"
        }
      ],
      "source": {
        "advisory": "GHSA-5vcm-3xc3-w7x3",
        "discovery": "UNKNOWN"
      },
      "title": "Response Splitting from unsanitized headers in http4s",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-41084",
          "STATE": "PUBLIC",
          "TITLE": "Response Splitting from unsanitized headers in http4s"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "http4s",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= 0.21.28"
                          },
                          {
                            "version_value": "\u003e= 0.22.0, \u003c 0.22.5"
                          },
                          {
                            "version_value": "\u003e= 0.23.0, \u003c 0.23.4"
                          },
                          {
                            "version_value": "\u003e= 1.0.0-M1, \u003c 1.0.0-M27"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "http4s"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`\u00e5), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-918: Server-Side Request Forgery (SSRF)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3",
              "refsource": "CONFIRM",
              "url": "https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3"
            },
            {
              "name": "https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8",
              "refsource": "MISC",
              "url": "https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8"
            },
            {
              "name": "https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values",
              "refsource": "MISC",
              "url": "https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values"
            },
            {
              "name": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting",
              "refsource": "MISC",
              "url": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-5vcm-3xc3-w7x3",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-41084",
    "datePublished": "2021-09-21T17:20:14",
    "dateReserved": "2021-09-15T00:00:00",
    "dateUpdated": "2024-08-04T02:59:31.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"0.21.29\", \"matchCriteriaId\": \"B0B6AFB9-30AE-4CB0-98E8-80E2066211CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"0.22.0\", \"versionEndExcluding\": \"0.22.5\", \"matchCriteriaId\": \"B0D7EA70-14A9-4DB3-B96C-2FA713040D65\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"0.23.0\", \"versionEndExcluding\": \"0.23.4\", \"matchCriteriaId\": \"9A613C47-29E5-484C-AEBF-C3B5EB5ED3CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*\", \"matchCriteriaId\": \"65C497F9-281C-4565-BD36-B6B4D7E6F8BD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*\", \"matchCriteriaId\": \"6FCFC3E5-7530-4AAA-A2C7-36DC307B613B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*\", \"matchCriteriaId\": \"D03CBFE3-0B31-4D7C-BC5D-61DCD3C2C486\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*\", \"matchCriteriaId\": \"76F8BC53-544C-4285-8D9B-CB91AD080048\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*\", \"matchCriteriaId\": \"778947CA-20BA-469F-87E1-97D8713ACC75\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*\", \"matchCriteriaId\": \"F5B02828-1E40-49BE-8367-10296625C696\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*\", \"matchCriteriaId\": \"A569F32F-3C8C-4F8F-B0BC-6ADC993596A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*\", \"matchCriteriaId\": \"525DBF4B-F574-459D-9CE2-6AF597ABAE10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD05B15E-1E4F-43EA-B21A-3B96A77814D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*\", \"matchCriteriaId\": \"65C79F52-F05F-4F0A-AC27-393197B9EF00\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*\", \"matchCriteriaId\": \"A426B4C0-643A-492F-B7FB-725549F613F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*\", \"matchCriteriaId\": \"D95E231C-3D13-45FC-AF9A-CB8CF1FFC983\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*\", \"matchCriteriaId\": \"CF973F58-0AC7-4B58-A2CF-654133CE7F1A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*\", \"matchCriteriaId\": \"35C40331-C96C-477C-B6BD-D5506E612DA8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*\", \"matchCriteriaId\": \"615BC827-3E0F-4C1E-8FD2-B59FF31F2D49\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*\", \"matchCriteriaId\": \"FDFB35FD-4D08-4895-B1B6-FC03BCB3EB22\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*\", \"matchCriteriaId\": \"97F74D04-031E-47D4-BA57-DBE9C74CE256\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*\", \"matchCriteriaId\": \"2FDC2E12-DE86-4A82-BD2F-C18F715CA673\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*\", \"matchCriteriaId\": \"C1C18467-5FD0-4DCC-8B75-979C03BFF1C4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*\", \"matchCriteriaId\": \"DE093D65-1B3A-4A4A-BC76-05DEF9529712\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC3CA618-148D-4F97-9913-316DDDD97838\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*\", \"matchCriteriaId\": \"02FA538C-9D8A-49D5-8268-1A2C3E96B89B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*\", \"matchCriteriaId\": \"D18A3ABC-5C47-45BF-978C-5BB17787DCFA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*\", \"matchCriteriaId\": \"1CE1CF51-E61A-418A-AB22-9D7A6D690BAA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*\", \"matchCriteriaId\": \"29A70AAA-B77A-4291-A700-C910362DB8D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F8F3C38-57AB-4CBC-8959-7FF51CBA7907\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`\\u00e5), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.\"}, {\"lang\": \"es\", \"value\": \"http4s es una interfaz scala de c\\u00f3digo abierto para HTTP. En las versiones afectadas, http4s es vulnerable a ataques de divisi\\u00f3n de respuestas o de peticiones cuando entradas de usuario no confiables son usadas para crear cualquiera de los siguientes campos: Header names (\\\"Header.name\\\"), Header values (\\\"Header.value\\\"), Status reason phrases (\\\"Status.reason\\\"), URI paths (\\\"Uri.Path\\\"), URI authority registered names (\\\"URI.RegName\\\") (versiones hasta 0.21). Este problema ha sido resuelto en versiones 0.21.30, 0.22.5, 0.23.4 y 1.0.0-M27 llevan a cabo lo siguiente. Como cuesti\\u00f3n de pr\\u00e1ctica, los servicios http4s y las aplicaciones cliente deber\\u00edan sanear cualquier entrada del usuario en los campos mencionados antes de devolver una petici\\u00f3n o respuesta al backend. Los caracteres carriage return, newline y null son los m\\u00e1s amenazantes\"}]",
      "id": "CVE-2021-41084",
      "lastModified": "2024-11-21T06:25:25.353",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N\", \"baseScore\": 8.7, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.8}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2021-09-21T18:15:07.427",
      "references": "[{\"url\": \"https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://owasp.org/www-community/attacks/HTTP_Response_Splitting\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://owasp.org/www-community/attacks/HTTP_Response_Splitting\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-918\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-74\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-41084\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2021-09-21T18:15:07.427\",\"lastModified\":\"2024-11-21T06:25:25.353\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (`Header.name`\u00e5), Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.\"},{\"lang\":\"es\",\"value\":\"http4s es una interfaz scala de c\u00f3digo abierto para HTTP. En las versiones afectadas, http4s es vulnerable a ataques de divisi\u00f3n de respuestas o de peticiones cuando entradas de usuario no confiables son usadas para crear cualquiera de los siguientes campos: Header names (\\\"Header.name\\\"), Header values (\\\"Header.value\\\"), Status reason phrases (\\\"Status.reason\\\"), URI paths (\\\"Uri.Path\\\"), URI authority registered names (\\\"URI.RegName\\\") (versiones hasta 0.21). Este problema ha sido resuelto en versiones 0.21.30, 0.22.5, 0.23.4 y 1.0.0-M27 llevan a cabo lo siguiente. Como cuesti\u00f3n de pr\u00e1ctica, los servicios http4s y las aplicaciones cliente deber\u00edan sanear cualquier entrada del usuario en los campos mencionados antes de devolver una petici\u00f3n o respuesta al backend. Los caracteres carriage return, newline y null son los m\u00e1s amenazantes\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.8},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-918\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-74\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.21.29\",\"matchCriteriaId\":\"B0B6AFB9-30AE-4CB0-98E8-80E2066211CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.22.0\",\"versionEndExcluding\":\"0.22.5\",\"matchCriteriaId\":\"B0D7EA70-14A9-4DB3-B96C-2FA713040D65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.23.0\",\"versionEndExcluding\":\"0.23.4\",\"matchCriteriaId\":\"9A613C47-29E5-484C-AEBF-C3B5EB5ED3CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*\",\"matchCriteriaId\":\"65C497F9-281C-4565-BD36-B6B4D7E6F8BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FCFC3E5-7530-4AAA-A2C7-36DC307B613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*\",\"matchCriteriaId\":\"D03CBFE3-0B31-4D7C-BC5D-61DCD3C2C486\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*\",\"matchCriteriaId\":\"76F8BC53-544C-4285-8D9B-CB91AD080048\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*\",\"matchCriteriaId\":\"778947CA-20BA-469F-87E1-97D8713ACC75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5B02828-1E40-49BE-8367-10296625C696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*\",\"matchCriteriaId\":\"A569F32F-3C8C-4F8F-B0BC-6ADC993596A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*\",\"matchCriteriaId\":\"525DBF4B-F574-459D-9CE2-6AF597ABAE10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD05B15E-1E4F-43EA-B21A-3B96A77814D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*\",\"matchCriteriaId\":\"65C79F52-F05F-4F0A-AC27-393197B9EF00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*\",\"matchCriteriaId\":\"A426B4C0-643A-492F-B7FB-725549F613F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D95E231C-3D13-45FC-AF9A-CB8CF1FFC983\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF973F58-0AC7-4B58-A2CF-654133CE7F1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*\",\"matchCriteriaId\":\"35C40331-C96C-477C-B6BD-D5506E612DA8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*\",\"matchCriteriaId\":\"615BC827-3E0F-4C1E-8FD2-B59FF31F2D49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDFB35FD-4D08-4895-B1B6-FC03BCB3EB22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*\",\"matchCriteriaId\":\"97F74D04-031E-47D4-BA57-DBE9C74CE256\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone25:*:*:*:*:*:*\",\"matchCriteriaId\":\"2FDC2E12-DE86-4A82-BD2F-C18F715CA673\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone26:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1C18467-5FD0-4DCC-8B75-979C03BFF1C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE093D65-1B3A-4A4A-BC76-05DEF9529712\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC3CA618-148D-4F97-9913-316DDDD97838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*\",\"matchCriteriaId\":\"02FA538C-9D8A-49D5-8268-1A2C3E96B89B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*\",\"matchCriteriaId\":\"D18A3ABC-5C47-45BF-978C-5BB17787DCFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CE1CF51-E61A-418A-AB22-9D7A6D690BAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*\",\"matchCriteriaId\":\"29A70AAA-B77A-4291-A700-C910362DB8D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F8F3C38-57AB-4CBC-8959-7FF51CBA7907\"}]}]}],\"references\":[{\"url\":\"https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://owasp.org/www-community/attacks/HTTP_Response_Splitting\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://owasp.org/www-community/attacks/HTTP_Response_Splitting\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.