~ / search / GHSA-h385-52j6-9984

GHSA-h385-52j6-9984

Withdrawn on 2021-01-13. GitHub withdrew this advisory; it no longer applies.

Withdrawn: HTTP Request Smuggling in Agoo

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7670

Packages

EcosystemPackageAffectedFixed in
RubyGems agoo <= 2.13.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

# Withdrawn reason Withdrawn on 1/13/2021 due to [this comment from the maintainer](https://github.com/ohler55/agoo/issues/88#issuecomment-723580783). This is no longer considered a vulnerability. # Original description agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.

References

External links from the advisory. They lead to third-party sites.