Lucene search

GitHub_MCVELIST:CVE-2019-16771

HistoryDec 06, 2019 - 7:00 p.m.

CVE-2019-16771 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria

2019-12-0619:00:20

CWE-113

GitHub_M

www.cve.org

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.

CNA Affected

[
  {
    "product": "Armeria",
    "vendor": "LINE",
    "versions": [
      {
        "lessThan": "0.97.0",
        "status": "affected",
        "version": "< 0.97.0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/line/armeria/commit/b597f7a865a527a84ee3d6937075cfbb4470ed20

github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

Related for CVELIST:CVE-2019-16771