OMGeeky/advisory-db
1
0
Fork 0
mirror of https://github.com/OMGeeky/advisory-db.git synced 2026-02-23 15:38:27 +01:00
Code Issues Packages Projects Releases Wiki Activity

Note that another vulnerability is needed for RCE

Browse Source 
Also make some trivial changes to pass the linter.
This commit is contained in:
Demi M. Obenour
2020-03-30 18:57:51 -04:00
parent 8b6786f78c
commit 91eed85346
1 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
crates/hyper/RUSTSEC-2020-0000.toml → crates/hyper/RUSTSEC-0000-0000.toml
View File

@@ -1,6 +1,3 @@
# Before you submit a PR using this template, **please delete the comments**
# explaining each field, as well as any unused fields.
[advisory] [advisory]
id = "RUSTSEC-0000-0000" id = "RUSTSEC-0000-0000"
package = "hyper" package = "hyper"
@@ -10,11 +7,6 @@ url = "https://github.com/hyperium/hyper/issues/1925"
categories = ["format-injection"] categories = ["format-injection"]
keywords = ["http", "request-smuggling"] keywords = ["http", "request-smuggling"]
# Vulnerability aliases, e.g. CVE IDs (optional but recommended)
# Request a CVE for your RustSec vulns: https://iwantacve.org/
#aliases = ["CVE-2018-XXXX"]
# Enter a short-form description of the vulnerability here (mandatory)
description = """ description = """
Vulnerable versions of hyper allow GET requests to have bodies, even if there is Vulnerable versions of hyper allow GET requests to have bodies, even if there is
no Transfer-Encoding or Content-Length header. As per the HTTP 1.1 no Transfer-Encoding or Content-Length header. As per the HTTP 1.1
@@ -24,13 +16,12 @@ as a separate HTTP request.
This allows an attacker who can control the body and method of an HTTP request This allows an attacker who can control the body and method of an HTTP request
made by hyper to inject a request with headers that would not otherwise be made by hyper to inject a request with headers that would not otherwise be
allowed, as demonstrated by sending a malformed HTTP request from a Substrate allowed, as demonstrated by sending a malformed HTTP request from a Substrate
runtime. This allows bypassing CORS restrictions and may allow remote code runtime. This allows bypassing CORS restrictions. In combination with other
execution in certain scenarios, such as if there is an exploitable web server vulnerabilities, such as an exploitable web server listening on loopback, it may
listening on loopback. allow remote code execution.
The flaw was corrected in hyper version 0.12.35. The flaw was corrected in hyper version 0.12.35.
""" """
# Versions which include fixes for this vulnerability (mandatory)
[versions] [versions]
patched = [">= 0.12.35"] patched = [">= 0.12.35"]