The vulnerability of the HTTP-interaction protocol implementation, related to deficiencies in HTTP request processing, allows attackers to circumvent security restrictions and send hidden HTTP requests (HTTP Request Smuggling attack).

🗓️ 11 Aug 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Hypertext protocol processing defects enable request smuggling, bypassing security and sending hidden requests.

Reporter	Title	Published	Views	Family All 30
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.4 fixes multiple security vulnerabilities	15 Dec 202314:31	–	ibm
CBLMariner	CVE-2023-38697 affecting package rubygem-protocol-http1 for versions less than 0.15.1-1	30 Aug 202314:44	–	cbl_mariner
Circl	CVE-2023-38697	4 Aug 202322:41	–	circl
CNNVD	protocol-http1 environmental issue vulnerability	4 Aug 202300:00	–	cnnvd
CVE	CVE-2023-38697	4 Aug 202317:32	–	cve
Cvelist	CVE-2023-38697 protocol-http1 HTTP Request/Response Smuggling vulnerability	4 Aug 202317:32	–	cvelist
Debian CVE	CVE-2023-38697	4 Aug 202317:32	–	debiancve
EUVD	EUVD-2023-2225	3 Oct 202520:07	–	euvd
Github Security Blog	protocol-http1 HTTP Request/Response Smuggling vulnerability	3 Aug 202316:36	–	github
Tenable Nessus	CBL Mariner 2.0 Security Update: rubygem-protocol-http1 (CVE-2023-38697)	31 Aug 202300:00	–	nessus

Source	Link
github	www.github.com/socketry/protocol-http1/commit/e11fc164fd2b36f7b7e785e69fa8859eb06bcedd
github	www.github.com/socketry/protocol-http1/pull/20
github	www.github.com/socketry/protocol-http1/security/advisories/GHSA-6jwc-qr2q-7xwj
rfc-editor	www.rfc-editor.org/rfc/rfc9112
web	www.web.nvd.nist.gov/view/vuln/detail

11 Aug 2023 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 25

CVSS 35.8

EPSS0.00204

Hypertext protocol request smuggling security bypass hidden requests processing defects