GHSA-35FR-H7JR-HH86中危已审查

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria

OSV 1.4.0 · github-reviewed · 修改于 2021-04-28 02:03

发布时间

2019-12-07 02:55

GitHub 审查时间

2021-04-28 02:03

NVD 发布时间

—

源文件

advisories/github-reviewed/2019/12/GHSA-35fr-h7jr-hh86/GHSA-35fr-h7jr-hh86.json

公告说明

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.

Impact

Cross-User Defacement
Cache Poisoning
Cross-Site Scripting (XSS)
Page Hijacking

Root Cause

The root cause is due to the usage of Netty without the HTTP header validation.

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/common/DefaultHttpHeaders.java#L23

Patches

This vulnerability has been patched in 0.97.0.

References

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j

For more information

If you have any questions or comments about this advisory:

Open an issue in GitHub

受影响的软件包

标识信息

别名 / CVE

无

CWE

CWE-113CWE-74

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-35fr-h7jr-hh86",
  "aliases": [],
  "details": "Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.\n\n### Impact\n\n1. Cross-User Defacement\n2. Cache Poisoning\n3. Cross-Site Scripting (XSS)\n4. Page Hijacking\n\n\n### Root Cause\n\nThe root cause is due to the usage of Netty without the HTTP header validation.\n\nhttps://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/common/DefaultHttpHeaders.java#L23\n\n### Patches\n\nThis vulnerability has been patched in 0.97.0.\n\n### References\n\n[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)\nhttps://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [GitHub](https://github.com/line/armeria/issues)",
  "summary": "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0.85.0"
            },
            {
              "fixed": "0.97.0"
            }
          ]
        }
      ],
      "package": {
        "name": "com.linecorp.armeria:armeria",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2021-04-27T18:03:07Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
    }
  ],
  "published": "2019-12-06T18:55:47Z",
  "references": [
    {
      "url": "https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-113",
      "CWE-74"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-04-27T18:03:07Z"
  }
}