Response Splitting from unsanitized headers in http4s
CVE-2021-41084

8.7HIGH

Key Information:

Vendor

Http4s

Status
Http4s
Vendor
CVE Published:
21 September 2021

What is CVE-2021-41084?

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (Header.nameå), Header values (Header.value), Status reason phrases (Status.reason), URI paths (Uri.Path), URI authority registered names (URI.RegName) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

http4s <= 0.21.28 <= 0.21.28

http4s >= 0.22.0, < 0.22.5 < 0.22.0, 0.22.5

http4s >= 0.23.0, < 0.23.4 < 0.23.0, 0.23.4

References

https://github.com/http4s/http4s/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/http4s/http4s/commit/d02007db1da4f8f3d...
x_refsource_MISC
https://httpwg.org/http-core/draft-ietf-httpbis-semantics...
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.