Lucene search

K
osvGoogleOSV:RUSTSEC-2017-0002
HistoryJan 23, 2017 - 12:00 p.m.

headers containing newline characters can split messages

2017-01-2312:00:00
Google
osv.dev
8

0.001 Low

EPSS

Percentile

35.9%

Serializing of headers to the socket did not filter the values for newline bytes (\r or \n),
which allowed for header values to split a request or response. People would not likely include
newlines in the headers in their own applications, so the way for most people to exploit this
is if an application constructs headers based on unsanitized user input.

This issue was fixed by replacing all newline characters with a space during serialization of
a header value.

CPENameOperatorVersion
hyperge0.10.0
hyperlt0.10.2
hyperlt0.9.18

0.001 Low

EPSS

Percentile

35.9%