GHSA-CCCF-7XW3-P2VR中危已审查

HTTP Request Smuggling in Undertow

OSV 1.4.0 · github-reviewed · 修改于 2022-02-12 05:12

发布时间

2021-05-01 01:28

GitHub 审查时间

2021-04-29 00:37

NVD 发布时间

2020-05-27 00:15

源文件

advisories/github-reviewed/2021/04/GHSA-cccf-7xw3-p2vr/GHSA-cccf-7xw3-p2vr.json

公告说明

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

受影响的软件包

Maven

io.undertow:undertow-core

ECOSYSTEM

引入0修复2.1.1.Final

标识信息

别名 / CVE

CVE-2020-10719

CWE

CWE-444

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-cccf-7xw3-p2vr",
  "aliases": [
    "CVE-2020-10719"
  ],
  "details": "A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.",
  "summary": "HTTP Request Smuggling in Undertow",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.1.Final"
            }
          ]
        }
      ],
      "package": {
        "name": "io.undertow:undertow-core",
        "ecosystem": "Maven"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 2.1.0.Final"
      }
    }
  ],
  "modified": "2022-02-11T21:12:25Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
    }
  ],
  "published": "2021-04-30T17:28:33Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719",
      "type": "ADVISORY"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10719",
      "type": "WEB"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20220210-0014",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2020-05-26T16:15:00Z",
    "github_reviewed_at": "2021-04-28T16:37:37Z"
  }
}