CVE-2023-27522: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
(updated )
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55.
Special characters in the origin response header can truncate/split the response forwarded to the client.
References
- github.com/advisories/GHSA-vcph-37mh-fqrh
- github.com/apache/httpd/commit/d753ea76b5972a85349b68c31b59d04c60014f2d
- github.com/unbit/uwsgi/commit/58ee1df31fa9e9af106aaeabb82374c36b433822
- github.com/unbit/uwsgi/commit/acb03530aaaeaa810f28a5b64da619525940f569
- httpd.apache.org/security/vulnerabilities_24.html
- lists.debian.org/debian-lts-announce/2023/04/msg00028.html
- nvd.nist.gov/vuln/detail/CVE-2023-27522
- uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.22.html
Code Behaviors & Features
Detect and mitigate CVE-2023-27522 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →