io.ratpack:ratpack-codahale-metrics (0.9.2), io.ratpack:ratpack-groovy (0.9.2) +12 more potentially affected by CVE-2019-17513 via io.ratpack:ratpack-core (0.9.2)

io.ratpack:ratpack-core MAVEN version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.2 - io.ratpack:ratpack-groovy 0.9.2 - io.ratpack:ratpack-groovy-test 0.9....

GHSA-MVQP-Q37C-WF9J io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' Versions of Ratpack 0.9.1 through and including 1.7.4 are vulnerable to HTTP Response Splitting, if untrusted and unsanitized data is used to populate the headers of an HTTP response. An attacker can...

io.ratpack:ratpack-codahale-metrics (0.9.4), io.ratpack:ratpack-groovy (0.9.4) +14 more potentially affected by CVE-2019-17513 via io.ratpack:ratpack-core (0.9.4)

io.ratpack:ratpack-core MAVEN version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.4 - io.ratpack:ratpack-groovy 0.9.4 - io.ratpack:ratpack-groovy-test 0.9....

io.ratpack:ratpack-codahale-metrics (0.9.14), io.ratpack:ratpack-config (0.9.14) +17 more potentially affected by CVE-2019-17513 via io.ratpack:ratpack-core (0.9.14)

io.ratpack:ratpack-core MAVEN version 0.9.14 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.14 - io.ratpack:ratpack-config 0.9.14 - io.ratpack:ratpack-groovy 0.9.14...

io.ratpack:ratpack-codahale-metrics (0.9.15), io.ratpack:ratpack-config (0.9.15) +17 more potentially affected by CVE-2019-17513 via io.ratpack:ratpack-core (0.9.15)

io.ratpack:ratpack-core MAVEN version 0.9.15 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.15 - io.ratpack:ratpack-config 0.9.15 - io.ratpack:ratpack-groovy 0.9.15...

io.ratpack:ratpack-codahale-metrics (0.9.8), io.ratpack:ratpack-groovy (0.9.8) +15 more potentially affected by CVE-2019-17513 via io.ratpack:ratpack-core (0.9.8)

io.ratpack:ratpack-core MAVEN version 0.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.8 - io.ratpack:ratpack-groovy 0.9.8 - io.ratpack:ratpack-groovy-test 0.9....

io.ratpack:ratpack-codahale-metrics (0.9.0), io.ratpack:ratpack-groovy (0.9.0) +10 more potentially affected by CVE-2019-17513 via io.ratpack:ratpack-core (0.9.0)

io.ratpack:ratpack-core MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-core and may be impacted: - io.ratpack:ratpack-codahale-metrics 0.9.0 - io.ratpack:ratpack-groovy 0.9.0 - io.ratpack:ratpack-groovy-test 0.9....

HTTP Response Splitting

ratpack-core is vulnerable to HTTP response splitting. The vulnerability exists due to the lack of validation of response header values as the DefaultHttpHeaders object is created with verification disabled by default, allowing malicious user-supplied values to be part of response headers...

Ratpack Input Validation Error Vulnerability

Ratpack is a Java library for building scalable HTTP applications. An input validation error vulnerability exists in Ratpack versions prior to 1.7.5, which can be exploited to conduct http response splitting attacks by constructing HTTP headers with untrusted data...

CVE-2019-17513

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur...

CVE-2019-17513

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur...

Design/Logic Flaw

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur...

CVE-2019-17513

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur...

CVE-2019-17513

CVE-2019-17513 affects Ratpack before 1.7.5. The root cause is misuse of Netty’s DefaultHttpHeaders with validation disabled, allowing untrusted input used in HTTP headers to cause HTTP Response Splitting (CRLF injection). Upgrading Ratpack to 1.7.5 (or later) patches the issue by restoring heade...

CVE-2019-17513

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur...

PT-2019-15179

Name of the Vulnerable Software and Affected Versions Ratpack versions 0.9.1 through 1.7.4 Description An issue in Ratpack allows HTTP Response Splitting to occur due to a misuse of the Netty library class DefaultHttpHeaders, where there is no validation that headers lack HTTP control characters...

CVE-2019-17513: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur...

HTTP Response Splitting

Overview io.ratpack:ratpack-core is a simple, capable, toolkit for creating high performance web applications. Affected versions of this package are vulnerable to HTTP Response Splitting. If untrusted and unsanitized data is used to populate the headers of an HTTP response, an attacker can utiliz...

io.ratpack:ratpack-groovy-test (0.9.0) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (0.9.0)

io.ratpack:ratpack-groovy MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-groovy and may be impacted: - io.ratpack:ratpack-groovy-test 0.9.0 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...

io.ratpack:ratpack-groovy-test (0.9.19) potentially affected by CVE-2019-11808 via io.ratpack:ratpack-groovy (0.9.19)

io.ratpack:ratpack-groovy MAVEN version 0.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on io.ratpack:ratpack-groovy and may be impacted: - io.ratpack:ratpack-groovy-test 0.9.19 Source cves: CVE-2019-11808 Source advisory: OSV:GHSA-54MG-VGRP-MWX9...