blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Summary blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names/values e.g. X-Forwarded-For, internal-auth headers that a fronting proxy sanitized from the...

org.http4s:http4s-blazeserver_2.10 (0.8.1), org.http4s:http4s-jetty_2.10 (0.8.1) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.8.1)

org.http4s:http4s-server2.10 MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.8.1 - org.http4s:http4s-jetty2.10 0.8.1 -...

org.http4s:http4s-blazeserver_2.11 (0.5.1), org.http4s:http4s-jetty_2.11 (0.5.1) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.5.1)

org.http4s:http4s-server2.11 MAVEN version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.5.1 - org.http4s:http4s-jetty2.11 0.5.1 -...

org.http4s:http4s-blazeserver_2.11 (0.6.1), org.http4s:http4s-jetty_2.11 (0.6.1) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.6.1)

org.http4s:http4s-server2.11 MAVEN version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.6.1 - org.http4s:http4s-jetty2.11 0.6.1 -...

org.http4s:http4s-blazeserver_2.10 (0.6.4), org.http4s:http4s-jetty_2.10 (0.6.4) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.6.4)

org.http4s:http4s-server2.10 MAVEN version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.6.4 - org.http4s:http4s-jetty2.10 0.6.4 -...

org.http4s:http4s-blazeserver_2.10 (0.7.0), org.http4s:http4s-jetty_2.10 (0.7.0) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.7.0)

org.http4s:http4s-server2.10 MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.7.0 - org.http4s:http4s-jetty2.10 0.7.0 -...

org.http4s:http4s-blazeserver_2.10 (0.6.2), org.http4s:http4s-jetty_2.10 (0.6.2) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.6.2)

org.http4s:http4s-server2.10 MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.6.2 - org.http4s:http4s-jetty2.10 0.6.2 -...

org.http4s:http4s-blazeserver_2.10 (0.6.5), org.http4s:http4s-jetty_2.10 (0.6.5) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.6.5)

org.http4s:http4s-server2.10 MAVEN version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.6.5 - org.http4s:http4s-jetty2.10 0.6.5 -...

org.http4s:http4s-blazeserver_2.10 (0.8.0), org.http4s:http4s-jetty_2.10 (0.8.0) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.8.0)

org.http4s:http4s-server2.10 MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.8.0 - org.http4s:http4s-jetty2.10 0.8.0 -...

org.http4s:http4s-blazeserver_2.10 (0.8.2), org.http4s:http4s-jetty_2.10 (0.8.2) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.8.2)

org.http4s:http4s-server2.10 MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.8.2 - org.http4s:http4s-jetty2.10 0.8.2 -...

org.http4s:http4s-blazeserver_2.11 (0.3.0), org.http4s:http4s-jetty_2.11 (0.3.0) +6 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.3.0)

org.http4s:http4s-server2.11 MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.3.0 - org.http4s:http4s-jetty2.11 0.3.0 -...

org.http4s:http4s-blazeserver_2.11 (0.5.0), org.http4s:http4s-jetty_2.11 (0.5.0) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.5.0)

org.http4s:http4s-server2.11 MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.5.0 - org.http4s:http4s-jetty2.11 0.5.0 -...

org.http4s:http4s-blazeserver_2.11 (0.6.2), org.http4s:http4s-jetty_2.11 (0.6.2) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.6.2)

org.http4s:http4s-server2.11 MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.6.2 - org.http4s:http4s-jetty2.11 0.6.2 -...

org.http4s:http4s-blazeserver_2.11 (0.6.3), org.http4s:http4s-jetty_2.11 (0.6.3) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.6.3)

org.http4s:http4s-server2.11 MAVEN version 0.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.6.3 - org.http4s:http4s-jetty2.11 0.6.3 -...

org.http4s:http4s-blazeserver_2.11 (0.8.2), org.http4s:http4s-jetty_2.11 (0.8.2) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.8.2)

org.http4s:http4s-server2.11 MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.8.2 - org.http4s:http4s-jetty2.11 0.8.2 -...

org.http4s:http4s-blazeserver_2.11 (0.8.3), org.http4s:http4s-jetty_2.11 (0.8.3) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.8.3)

org.http4s:http4s-server2.11 MAVEN version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blazeserver2.11 0.8.3 - org.http4s:http4s-jetty2.11 0.8.3 -...

org.http4s:http4s-blazeserver_2.10 (0.3.0), org.http4s:http4s-jetty_2.10 (0.3.0) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.3.0)

org.http4s:http4s-server2.10 MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.3.0 - org.http4s:http4s-jetty2.10 0.3.0 -...

org.http4s:http4s-blazeserver_2.10 (0.4.1), org.http4s:http4s-jetty_2.10 (0.4.1) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.4.1)

org.http4s:http4s-server2.10 MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.4.1 - org.http4s:http4s-jetty2.10 0.4.1 -...

org.http4s:http4s-blazeserver_2.10 (0.5.3), org.http4s:http4s-jetty_2.10 (0.5.3) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.5.3)

org.http4s:http4s-server2.10 MAVEN version 0.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.5.3 - org.http4s:http4s-jetty2.10 0.5.3 -...

org.http4s:http4s-blazeserver_2.10 (0.5.4), org.http4s:http4s-jetty_2.10 (0.5.4) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.5.4)

org.http4s:http4s-server2.10 MAVEN version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blazeserver2.10 0.5.4 - org.http4s:http4s-jetty2.10 0.5.4 -...