Open mend-bolt-for-github[bot] opened 3 years ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2021-32715 - Low Severity Vulnerability
Vulnerable Libraries - hyper-0.13.9.crate, hyper-0.12.35.crate
hyper-0.13.9.crate
A fast and correct HTTP library.
Library home page: https://crates.io/api/v1/crates/hyper/0.13.9/download
Path to dependency file: /packages/cactus-plugin-keychain-vault/src/cactus-keychain-vault-server/rust/gen/Cargo.toml
Path to vulnerable library: /packages/cactus-plugin-keychain-vault/src/cactus-keychain-vault-server/rust/gen/Cargo.toml
Dependency Hierarchy: - :x: **hyper-0.13.9.crate** (Vulnerable Library)
hyper-0.12.35.crate
A fast and correct HTTP library.
Library home page: https://crates.io/api/v1/crates/hyper/0.12.35/download
Path to dependency file: /packages/cactus-plugin-keychain-vault/src/cactus-keychain-vault-server/rust/gen/Cargo.toml
Path to vulnerable library: /packages/cactus-plugin-keychain-vault/src/cactus-keychain-vault-server/rust/gen/Cargo.toml
Dependency Hierarchy: - hashicorp_vault-1.1.0.crate (Root Library) - reqwest-0.9.24.crate - :x: **hyper-0.12.35.crate** (Vulnerable Library)
Found in base branch: master
Vulnerability Details
hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks". The flaw exists in all prior versions of hyper prior to 0.14.10, if built with `rustc` v1.5.0 or newer. The vulnerability is patched in hyper version 0.14.10. Two workarounds exist: One may reject requests manually that contain a plus sign prefix in the `Content-Length` header or ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix. Mend Note: Converted from WS-2020-0226, on 2021-08-19.
Publish Date: 2021-07-07
URL: CVE-2021-32715
CVSS 3 Score Details (3.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32715
Release Date: 2021-07-07
Fix Resolution: hyper - 0.14.10
Step up your Open Source Security Game with Mend here