CVE-2020-35884: HTTP Request smuggling in tiny_http
(updated )
HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
References
- github.com/advisories/GHSA-7v2r-wxmg-mgvc
- github.com/tiny-http/tiny-http
- github.com/tiny-http/tiny-http/commit/623b87397a569729c4bcabae747823c5668cce94
- github.com/tiny-http/tiny-http/issues/173
- github.com/tiny-http/tiny-http/pull/190
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M3JDNRE5RXJOWZZZF5QSCG4GUCSLTHF2
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO6SRTCEPEYO2OX647I3H5XUWLFDRDWL
- nvd.nist.gov/vuln/detail/CVE-2020-35884
- rustsec.org/advisories/RUSTSEC-2020-0031.html
Code Behaviors & Features
Detect and mitigate CVE-2020-35884 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →