CVE-2020-35884

An issue was discovered in the tinyhttp crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header...

Fedora: Security Advisory for rust-drg (FEDORA-2021-571e3ed33c)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-tiny_http0.6 (FEDORA-2021-c824326120)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

abrute (>=0.1.7, <=0.1.9), alipay-rs (>=0.2.0, <=0.4.6) +94 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.7.0)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.2.0, =0.0.1, =0.14.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =0.1.5, =0.1.1, =0.15.7, =0.1.0, =0.1.0, =0.1.17 and more Source cves: CVE-2020-35884 Source advisory: OSV:GHSA-7V2R-WXMG-MGVC...

CVE-2020-35884

creationtimestamp| type| source ---|---|--- 2020-12-31 12:37:28+00:00| seen| https://t.me/cibsecurity/21454...

CVE-2020-35884

CVE-2020-35884 affects the Rust tiny_http crate (through 2020-06-16). The issue enables HTTP Request smuggling via a malformed Transfer-Encoding header, as described in the CVE entry. The vulnerability is associated with partial confidentiality and partial integrity impact (per NVD CVSS metrics)....

abrute (>=0.1.7, <=0.1.9), alipay-rs (>=0.2.0, <=0.4.6) +94 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.7.0)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.2.0, =0.0.1, =0.14.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =0.1.5, =0.1.1, =0.15.7, =0.1.0, =0.1.0, =0.1.17 and more Source cves: CVE-2020-35884 Source advisory: SNYK:RUST-TINYHTTP-573057...

bevy-contrib-inspector (>=0.1.0, <=0.2.0), catenis_api_client (>=1.0.0, <=3.0.1) +21 more potentially affected by CVE-2020-35884 via tiny_http (0.7.0)

tinyhttp CARGO version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinyhttp and may be impacted: - bevy-contrib-inspector =0.1.0, =1.0.0, =0.16.0, =0.1.0, =0.9.0, =0.1.0, =0.1.0-alpha.0, =0.1.0, =0.6.2, =1.1.0, =0.1.1, =0.1.3 and more Source...

abrute (>=0.1.7, <=0.1.9), anterofit (>=0.0.1, <=0.0.2) +18 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.5.9)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.0.1, =0.0.1, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.5.0 and more Source cves: CVE-2020-35884 Source advisory: OSV:RUSTSEC-2020-0031...