HTTP Request Smuggling

Gunicorn is vulnerable to HTTP request smuggling. The vulnerability exists in parsechunksize of body.py due to discrepancies in parsing HTTP requests which allows an attacker to smuggle HTTP requests...

HTTP Request Smuggling

Gunicorn is vulnerable to HTTP request smuggling. The vulnerability is due the function setbodyreader in message.py. Due to enforcing the content length when the web socket key was received without relying on the headers provided in the request allows an attacker to smuggle HTTP request via...

SUSE-SU-2022:3571-1 Security update for rubygem-puma

This update for rubygem-puma fixes the following issues: Updated to version 4.3.12: - CVE-2022-24790: Fixed HTTP request smuggling if proxy is not RFC7230 compliant bsc1197818...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-2564)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-6037

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.0 through 8.5.82 Apache Tomcat versions 9.0.0-M1 through 9.0.67 Apache Tomcat versions 10.0.0-M1 through 10.0.26 Apache Tomcat versions 10.1.0-M1 through 10.1.0 Description The issue is related to the implementation ...

Amazon Linux 2 : golist (ALAS-2022-1847)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1847 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2022-2506)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-5371-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2 : golang, --advisory ALAS2-2022-1846 (ALAS-2022-1846)

The version of golang installed on the remote host is prior to 1.18.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1846 advisory. 2023-05-11: CVE-2022-1996 has changed status to NOT AFFECTED for this package and has been removed from this advisory. A...

EulerOS Virtualization 3.0.6.6 : httpd (EulerOS-SA-2022-2506)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A carefully crafted request body can cause a buffer overflow in the modlua multipart parser r:parsebody called from Lua scripts. T...

AlmaLinux 8 : nodejs:14 (ALSA-2022:6448)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:6448 advisory. nodejs: DNS rebinding in --inspect via invalid IP addresses CVE-2022-32212 nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding...

Ubuntu 16.04 ESM : nginx vulnerability (USN-5371-3)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5371-3 advisory. USN-5371-1 and USN-5371-2 fixed several vulnerabilities in nginx. This update provides the corresponding update for CVE-2020-11724 for Ubuntu 16.04 ESM. Tenable h...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple Go vulnerabilities

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple Go vulnerabilities with details below Vulnerability Details CVEID:CVE-2022-30631 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an uncontrolled recursion flaw in...

USN-5371-3: nginx vulnerability

USN-5371-1 and USN-5371-2 fixed several vulnerabilities in nginx. This update provides the corresponding update for CVE-2020-11724 for Ubuntu 16.04 ESM. Original advisory details: It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perfo...

Twisted vulnerable to HTTP Request Smuggling Attacks

Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 72...

GHSA-8R99-H8J2-RW64 Twisted vulnerable to HTTP Request Smuggling Attacks

Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 72...

SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2022:3524-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3524-1 advisory. Updated to version 16.17.1: - CVE-2022-32213: Fixed bypass via obs-fold mechanic bsc1201325. - CVE-2022-32215: Fixed incorrect...

SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2022:3503-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3503-1 advisory. - CVE-2022-35256: Fixed incorrect parsing of header fields bsc1203832. - CVE-2022-32213: Fixed bypass via obs-fold mechanic...

RHEL 8 : Red Hat Single Sign-On 7.5.3 security update on RHEL 8 (Moderate) (RHSA-2022:6783)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6783 advisory. Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2022:3516-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3516-1 advisory. Updated to version 14.20.1: - CVE-2022-32213: Fixed bypass via obs-fold mechanic bsc1201325. - CVE-2022-35256: Fixed incorrect...