easy-http-request (>=0.0.5 <=0.1.0), epic-wallet-rust-python (>=0.1.0 <=0.2.0) +8 more potentially affected by CVE-2021-21299 via hyper (>=0.12.12 <=0.12.19)

hyper CARGO version =0.12.12, =0.0.5, =0.1.0, =0.1.0, =3.3.2, =3.3.2, =3.3.2, =3.0.0, =3.0.0, =3.0.0, =3.0.5 Source cves: CVE-2021-21299 Source advisory: OSV:GHSA-6HFQ-H8HQ-87MF...

HTTP Request Smuggling in hyper

Summary hyper's HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary different...

curl (>=0.4.7 <=0.4.8), dns-lookup (>=0.7.0 <=0.8.1) +5 more potentially affected by CVE-2020-35919 +1 more via socket2 (=0.2.4)

socket2 CARGO version =0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on socket2 and may be impacted: - curl =0.4.7, =0.7.0, =0.3.0, =0.1.0, =0.2.2, =0.2.4 - miow =0.3.0 Source cves: CVE-2020-35919, CVE-2020-35920 Source advisory:...

GHSA-H3QR-RQ2J-74W4 HTTP Request Smuggling in hyper

Vulnerable versions of hyper allow GET requests to have bodies, even if there is no Transfer-Encoding or Content-Length header. As per the HTTP 1.1 specification, such requests do not have bodies, so the body will be interpreted as a separate HTTP request. This allows an attacker who can control...

algorithmia (=3.0.0-beta), approveapi (=0.1.0) +164 more potentially affected by CVE-2020-35863 via hyper (>=0.11.27 <=0.12.19)

hyper CARGO version =0.11.27, =0.1.0, =0.2.0, =1.5.0, =0.4.2, =0.1.0, =0.1.0, =0.37.0, =0.39.2 and more Source cves: CVE-2020-35863 Source advisory: OSV:GHSA-H3QR-RQ2J-74W4...

HTTP Request Smuggling in hyper

Vulnerable versions of hyper allow GET requests to have bodies, even if there is no Transfer-Encoding or Content-Length header. As per the HTTP 1.1 specification, such requests do not have bodies, so the body will be interpreted as a separate HTTP request. This allows an attacker who can control...

HTTPS MitM vulnerability due to lack of hostname verification

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests. This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch. The problem was addressed by...

GHSA-9XJR-M6F3-V5WM HTTPS MitM vulnerability due to lack of hostname verification

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests. This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch. The problem was addressed by...

AskAI (=0.1.0), BeerHolderBot (>=0.1.0 <=0.3.8) +15013 more potentially affected by CVE-2016-10932 via hyper (>=0.0.1 <=0.9.18)

hyper CARGO version =0.0.1, =0.1.0, =0.1.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.1, =0.0.2, =0.1.0, =0.1.2 and more Source cves: CVE-2016-10932 Source advisory: OSV:GHSA-9XJR-M6F3-V5WM...

acari-lib (>=0.1.1 <=0.1.8), acick (>=0.0.6 <=0.2.0-alpha.0) +1255 more potentially affected by CVE-2017-18587 via hyper (>=0.10.13 <=0.10.16)

hyper CARGO version =0.10.13, =0.1.1, =0.0.6, =0.0.7-alpha.3, =0.0.7-alpha.1, =0.1.0, =0.4.1, =0.1.0, =0.2.0, =0.0.1, =0.3.2, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2017-18587 Source advisory: OSV:GHSA-Q89X-F52W-6HJ2...

AskAI (=0.1.0), BeerHolderBot (>=0.1.0 <=0.3.8) +14875 more potentially affected by CVE-2017-18587 via hyper (>=0.0.1 <=0.9.14)

hyper CARGO version =0.0.1, =0.1.0, =0.1.0, =1.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.1, =0.0.2, =0.1.0, =0.1.2 and more Source cves: CVE-2017-18587 Source advisory: OSV:GHSA-Q89X-F52W-6HJ2...

Headers containing newline characters can split messages in hyper

Serializing of headers to the socket did not filter the values for newline bytes \r or \n, which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an...

GHSA-Q89X-F52W-6HJ2 Headers containing newline characters can split messages in hyper

Serializing of headers to the socket did not filter the values for newline bytes \r or \n, which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an...

CVE-2021-37841

Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with...

CVE-2021-37841

Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with...

Code injection

Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with...

CVE-2021-37841

Docker Desktop before 3.6.0 suffers from incorrect access control. If a low-privileged account is able to access the server running the Windows containers, it can lead to a full container compromise in both process isolation and Hyper-V isolation modes. This security issue leads an attacker with...

Docker Desktop 安全漏洞

Docker Desktop is a container technology-based desktop software for lightweight deployment of applications from the U.S. company Docker. The product provides a desktop environment that supports creating a container lightweight virtual machine and deploying and running applications on...

The vulnerability of the implementation of TCP/IP protocols in the Hyper-V virtualization system in the Windows operating system allows a perpetrator to execute arbitrary code.

The vulnerability of the TCP/IP protocol implementation in the Hyper-V virtualization system in the Windows operating system is related to errors in packet processing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PrintNightmare and RDP RCE among major issues tackled by Patch Tuesday

The sheer number of patches 44 security vulnerabilities should be enough to scare us, but unfortunately we have gotten used to those numbers. In fact, 44 is a low number compared to what we have seen on recent Patch Tuesdays. So what are the most notable vulnerabilities that were patched. One...