EUVD-2021-0909

Malware in sbrugna...

HTTP Request/Response Smuggling

com.typesafe.akka:akka-http-core is vulnerable to HTTP Request/Response Smuggling. The vulnerability is due to accepting malformed messages and handing them over to the user application, which may proxy them to another server without inspection, allowing unintended HTTP requests to reach downstre...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m4), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m4) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m4)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m4 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m4 -...

com.typesafe.akka:akka-http (3.0.0-rc1), com.typesafe.akka:akka-http-jackson (3.0.0-rc1) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core (3.0.0-rc1)

com.typesafe.akka:akka-http-core MAVEN version 3.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core and may be impacted: - com.typesafe.akka:akka-http 3.0.0-rc1 - com.typesafe.akka:akka-http-jackson 3.0.0-rc1 -...

com.github.benniekrijger:scala-postnl_2.11 (0.6), com.typesafe.akka:akka-http-experimental_2.11 (2.4.9-rc2) +9 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.9-rc2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.9-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.benniekrijger:scala-postnl2.11 0.6 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m1), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m1) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m1)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m1 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m3), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m3) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m3)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m3 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m3 -...

com.github.agourlay:cornichon_2.11 (>=0.10, <=0.10.1), com.github.benniekrijger:scala-mollie_2.11 (>=0.8, <=0.9) +7 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (3.0.0-rc1)

com.typesafe.akka:akka-http-core2.11 MAVEN version 3.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.github.agourlay:cornichon2.11 =0.10, =0.8, =0.2.7, =0.2.8 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4-artery-m2), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4-artery-m2) +3 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4-artery-m2)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4-artery-m2 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4-artery-m2 -...

com.typesafe.akka:akka-http-experimental_2.11 (2.4.2-rc3), com.typesafe.akka:akka-http-jackson-experimental_2.11 (2.4.2-rc3) +9 more potentially affected by CVE-2023-44487 via com.typesafe.akka:akka-http-core_2.11 (2.4.2-rc3)

com.typesafe.akka:akka-http-core2.11 MAVEN version 2.4.2-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core2.11 and may be impacted: - com.typesafe.akka:akka-http-experimental2.11 2.4.2-rc3 -...

ai.starlake:starlake-spark2_2.11 (0.2.7), be.objectify:deadbolt-java_2.11 (>=2.7.0, <=2.7.1) +396 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.11 (>=10.1.0, <=10.1.14)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.1.0, =2.7.0, =0.3.0, =1.10.0, =4.0.0-rc1, =1.0.0, =1.0.1-bump.0ef8b9fakka25circe08, =5.57.0akka25circe08, =0.11.2, =0.11.2+akka24circe011, =0.1.2akka25circe08, =0.1.3akka25circe08, =0.9.0, =3.0.0, =3.0.2 and more Source cves: CVE-2021-42697...

ai.starlake:starlake-spark2_2.11 (0.2.7), be.objectify:deadbolt-java_2.11 (>=2.7.0, <=2.7.1) +396 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.11 (>=10.1.0, <=10.1.14)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.1.0, =2.7.0, =0.3.0, =1.10.0, =4.0.0-rc1, =1.0.0, =1.0.1-bump.0ef8b9fakka25circe08, =5.57.0akka25circe08, =0.11.2, =0.11.2+akka24circe011, =0.1.2akka25circe08, =0.1.3akka25circe08, =0.9.0, =3.0.0, =3.0.2 and more Source cves: CVE-2021-42697...

Denial Of Service (DoS)

akka-http-core is vulnerable to Denial of Service DoS. A remote attacker is able to crash the application via a specifically crafted user-Agent header with deeply nested comments directed through vulnerable parser component...

ai.mantik:bridge-protocol_2.13 (>=0.4.0-rc1, <=0.4.0), ai.mantik:componently_2.13 (>=0.4.0-rc1, <=0.4.0) +428 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.13 (>=10.2.0-m1, <=10.2.6)

com.typesafe.akka:akka-http-core2.13 MAVEN version =10.2.0-m1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0-rc1, =0.4.0 and more Source cves: CVE-2021-42697 Source...

ai.starlake:starlake-spark2_2.11 (0.2.7), be.objectify:deadbolt-java_2.11 (>=2.7.0, <=2.7.1) +396 more potentially affected by CVE-2021-42697 via com.typesafe.akka:akka-http-core_2.11 (>=10.1.0, <=10.1.14)

com.typesafe.akka:akka-http-core2.11 MAVEN version =10.1.0, =2.7.0, =0.3.0, =1.10.0, =4.0.0-rc1, =1.0.0, =1.0.1-bump.0ef8b9fakka25circe08, =5.57.0akka25circe08, =0.11.2, =0.11.2+akka24circe011, =0.1.2akka25circe08, =0.1.3akka25circe08, =0.9.0, =3.0.0, =3.0.2 and more Source cves: CVE-2021-42697...

Security Bulletin: akka-http-core Vulnerability Affects IBM Watson Machine Learning on CP4D (CVE-2021-23339)

Summary akka-http-core allows is vulnerable to allow multiple Transfer-Encoding headers on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2021-23339 DESCRIPTION: com.typesafe.akka:akka-http-core is vulnerable to request smuggling, caused by improper validation of request. By...

com.typesafe.akka:akka-http (3.0.0-rc1), com.typesafe.akka:akka-http-jackson (3.0.0-rc1) +3 more potentially affected by CVE-2021-23339 via com.typesafe.akka:akka-http-core (3.0.0-rc1)

com.typesafe.akka:akka-http-core MAVEN version 3.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.typesafe.akka:akka-http-core and may be impacted: - com.typesafe.akka:akka-http 3.0.0-rc1 - com.typesafe.akka:akka-http-jackson 3.0.0-rc1 -...

CVE-2021-23339

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers...

Design/Logic Flaw

This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers...

CVE-2021-23339

CVE-2021-23339 affects com.typesafe.akka:akka-http-core. The flaw allows multiple Transfer-Encoding headers, enabling HTTP Request Smuggling due to improper validation of requests. Affected versions are all before 10.1.14 and 10.2.0–10.2.4. The issue is rooted in how Transfer-Encoding is handled,...