search

starcoinorg / starcoin

Starcoin - A Move smart contract blockchain network that scales by layering
Apache License 2.0
1.38k stars 289 forks source link

RUSTSEC-2020-0031: HTTP Request smuggling through malformed Transfer Encoding headers #1168

Open github-actions[bot] opened 4 years ago

github-actions[bot] commented 4 years ago

HTTP Request smuggling through malformed Transfer Encoding headers

Details
Package tiny_http
Version 0.6.2
URL https://github.com/tiny-http/tiny-http/issues/173
Date 2020-06-16

HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing.

It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers.

By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

See advisory page for additional details.

jolestar commented 3 years ago

wait https://github.com/tiny-http/tiny-http/issues/173