~ / search / GHSA-7v2r-wxmg-mgvc

GHSA-7v2r-wxmg-mgvc

HTTP Request smuggling in tiny_http

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-35884

Packages

EcosystemPackageAffectedFixed in
crates.io tiny_http < 0.8.0 0.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

References

External links from the advisory. They lead to third-party sites.