Insufficient Protection against HTTP Request Smuggling in mitmproxy

Impact In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While...

GHSA-GCX2-GVJ7-PXV3 Insufficient Protection against HTTP Request Smuggling in mitmproxy

Impact In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While...

hippolyzer (>=0.2.0, <=0.6.3), mitm-chrome (0.1.2) +2 more potentially affected by CVE-2022-24766 via mitmproxy (6.0.2)

mitmproxy PYPI version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - hippolyzer =0.2.0, =0.1.6, =0.11.3 - xepor 0.1.0 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

garbevents (2.0.9), hippolyzer (>=0.7.0, <=0.9.0) +3 more potentially affected by CVE-2022-24766 via mitmproxy (7.0.4)

mitmproxy PYPI version 7.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - garbevents 2.0.9 - hippolyzer =0.7.0, =1.1.1, =0.2.0, =0.3.0 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

http-tools (>=1.0.1, <=1.0.2), lyrebird (>=0.11.0, <=0.12.1) +2 more potentially affected by CVE-2022-24766 via mitmproxy (4.0.4)

mitmproxy PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - http-tools =1.0.1, =0.11.0, =1.2.1, =1.5.33, =1.5.41 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

comics-down (0.2.0), http-tools (1.1.0) potentially affected by CVE-2022-24766 via mitmproxy (5.0.1)

mitmproxy PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - comics-down 0.2.0 - http-tools 1.1.0 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

padsniff (>=0.9.0, <=1.1.0) potentially affected by CVE-2022-24766 via mitmproxy (0.18.2)

mitmproxy PYPI version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - padsniff =0.9.0, =1.1.0 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

sandroid (2.0.0), ui-automation-tools-mbt (>=1.1.1, <=1.3.1) potentially affected by CVE-2022-24766 via mitmproxy (0.17.0)

mitmproxy PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - sandroid 2.0.0 - ui-automation-tools-mbt =1.1.1, =1.3.1 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

mitmproxy-escher (1.0.0), mitmproxy-httpolice (0.7.1) potentially affected by CVE-2022-24766 via mitmproxy (3.0.4)

mitmproxy PYPI version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - mitmproxy-escher 1.0.0 - mitmproxy-httpolice 0.7.1 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

lyrebird (>=0.10.4, <=0.10.5) potentially affected by CVE-2022-24766 via mitmproxy (4.0.3)

mitmproxy PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - lyrebird =0.10.4, =0.10.5 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

mitmproxy-escher (>=0.1.2, <=0.1.3), padsniff (>=1.2.0, <=1.2.1) +1 more potentially affected by CVE-2022-24766 via mitmproxy (2.0.2)

mitmproxy PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - mitmproxy-escher =0.1.2, =1.2.0, =1.2.1 - pymultitor 2.1.0 Source cves: CVE-2022-24766 Source advisory: OSV:GHSA-GCX2-GVJ7-PXV3...

HTTP Request Smuggling

mitmproxy is vulnerable to HTTP request smuggling. The vulnerability exists because the header names contain whitespace characters by default, allowing an attacker to smuggle HTTP requests or responses by submitting a malicious message body...

DEBIAN-CVE-2022-24766

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of...

CVE-2022-24766

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of...

PYSEC-2022-170

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of...

Design/Logic Flaw

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of...

UBUNTU-CVE-2022-24766

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of...

sandroid (2.0.0), ui-automation-tools-mbt (>=1.1.1, <=1.3.1) potentially affected by CVE-2022-24766 via mitmproxy (0.17.0)

mitmproxy PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - sandroid 2.0.0 - ui-automation-tools-mbt =1.1.1, =1.3.1 Source cves: CVE-2022-24766 Source advisory: OSV:PYSEC-2022-170...

padsniff (>=0.9.0, <=1.1.0) potentially affected by CVE-2022-24766 via mitmproxy (0.18.2)

mitmproxy PYPI version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - padsniff =0.9.0, =1.1.0 Source cves: CVE-2022-24766 Source advisory: OSV:PYSEC-2022-170...

mitmproxy-escher (1.0.0), mitmproxy-httpolice (0.7.1) potentially affected by CVE-2022-24766 via mitmproxy (3.0.4)

mitmproxy PYPI version 3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - mitmproxy-escher 1.0.0 - mitmproxy-httpolice 0.7.1 Source cves: CVE-2022-24766 Source advisory: OSV:PYSEC-2022-170...