GHSA-54W6-VXFH-FW7F Http4s improperly parses User-Agent and Server headers

Impact The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. v0.21.x scala val unsafe: OptionUser-Agent = req.headers.getUser-Agent...

com.sksamuel.scruffy:scruffy-accord_2.10 (>=1.14.0-m1, <=1.14.0), com.sksamuel.scruffy:scruffy-akka_2.10 (>=1.14.0-m1, <=1.14.0) +46 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.10 (>=0.1.0, <=0.9.3)

org.http4s:http4s-core2.10 MAVEN version =0.1.0, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0 and more Source cves: CVE-2023-22465 Source advisory:...

ch.j3t:zio-prefetcher_2.13 (0.7.0), com.47deg:memeid4s-http4s_2.13 (0.3.0) +135 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.13 (>=0.22.0, <=0.22.14)

org.http4s:http4s-core2.13 MAVEN version =0.22.0, =0.8.0, =0.8.0, =2.0.0, =0.18.8, =0.17.0, =0.17.0, =0.12.0, =0.17.0, =0.12.0, =0.18.4 and more Source cves: CVE-2023-22465 Source advisory: GHSA-54W6-VXFH-FW7F...

ch.j3t:zio-prefetcher_2.12 (0.8.0-rc6), com.47deg:github4s_2.12 (>=0.29.1, <=0.32.0) +182 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.12 (>=0.23.0, <=0.23.16)

org.http4s:http4s-core2.12 MAVEN version =0.23.0, =0.29.1, =0.31.0, =0.4.0, =0.9.0, =0.9.0, =0.1-f497734, =0.1-f497734, =0.31.0, =0.31.0, =9.0.0, =9.1.0 - com.compstak:circe-geojson-http4s2.12 11.0.0 - com.compstak:kafka-connect-http4s2.12 0.6.0 - com.compstak:kafka-connect-migrate2.12 0.6.0 and...

com.sksamuel.scruffy:scruffy-accord_2.10 (>=1.14.0-m1, <=1.14.0), com.sksamuel.scruffy:scruffy-akka_2.10 (>=1.14.0-m1, <=1.14.0) +46 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.10 (>=0.1.0, <=0.9.3)

org.http4s:http4s-core2.10 MAVEN version =0.1.0, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0-m1, =1.14.0 and more Source cves: CVE-2023-22465 Source advisory:...

Http4s improperly parses User-Agent and Server headers

Impact The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. v0.21.x scala val unsafe: OptionUser-Agent = req.headers.getUser-Agent...

com.alejandrohdezma:scala-steward-core_2.13 (>=0.11.0, <=0.11.1), com.github.tototoshi:mvnsearch_2.13 (>=0.5.0, <=0.5.1) +138 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.13 (>=1.0.0-m2, <=1.0.0-m37)

org.http4s:http4s-core2.13 MAVEN version =1.0.0-m2, =0.11.0, =0.5.0, =1.3.0, =0.9.0-m2, =0.9.0-m2, =5.0.0-rc1, =5.0.0-rc1, =3.3.0-rc1, =0.4.1, =0.2.0, =0.3.0, =0.2.0, =0.2.1 and more Source cves: CVE-2023-22465 Source advisory: GHSA-54W6-VXFH-FW7F...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.47deg:embedded-cassandra-core_2.12 (0.0.7) +375 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.12 (>=0.10.0-m10, <=0.21.33)

org.http4s:http4s-core2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.6.1, =0.6.1, =0.18.1, =0.18.7 - com.avast:datadog4s-http4s2.12 0.6.0 - com.avast:datadog4s2.12 0.6.0 and more Source cves: CVE-2023-22465 Source advisory: GHSA-54W6-VXFH-FW7F...

CVE-2023-22465

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applie...

Design/Logic Flaw

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applie...

CVE-2023-22465 Http4s has fatal error parsing User-Agent and Server headers

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applie...

ch.j3t:zio-prefetcher_2.13 (0.7.0), com.47deg:memeid4s-http4s_2.13 (0.3.0) +135 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.13 (>=0.22.0, <=0.22.14)

org.http4s:http4s-core2.13 MAVEN version =0.22.0, =0.8.0, =0.8.0, =2.0.0, =0.18.8, =0.17.0, =0.17.0, =0.12.0, =0.17.0, =0.12.0, =0.18.4 and more Source cves: CVE-2023-22465 Source advisory: MEND:CVE-2023-22465...

CVE-2023-22465 Http4s has fatal error parsing User-Agent and Server headers

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applie...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0-rc4, <=1.6.1), ch.j3t:zio-prefetcher_2.13 (>=0.3.0, <=0.6.0) +326 more potentially affected by CVE-2023-22465 via org.http4s:http4s-core_2.13 (>=0.10.0-m10, <=0.21.33)

org.http4s:http4s-core2.13 MAVEN version =0.10.0-m10, =1.5.0-rc4, =0.3.0, =0.22.0, =0.2.0, =0.2.0, =0.1.0, =1.3.1, =1.3.1, =0.6.1, =0.13.1, =0.11.2, =0.12.1, =0.7.2, =0.13.2 and more Source cves: CVE-2023-22465 Source advisory: MEND:CVE-2023-22465...

CVE-2023-22465

Http4s (Scala HTTP services) has a vulnerability where the User-Agent and Server header parsers can fatal‑error on certain inputs. Affected versions include 0.1.0 up to but not including 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a...

CVE-2023-22465

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the "User-Agent" and "Server" header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only...

CVE-2023-22465 Http4s has fatal error parsing User-Agent and Server headers

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applie...

CVE-2023-22465: Improper Input Validation

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applie...

PT-2023-18517 · Http4S · Http4S

Name of the Vulnerable Software and Affected Versions: Http4s versions 0.1.0 through 0.21.33 Http4s versions 0.22.0 through 0.22.14 Http4s versions 0.23.0 through 0.23.16 Http4s versions 1.0.0-M0 through 1.0.0-M37 Description: The User-Agent and Server header parsers in Http4s are susceptible to ...

Malicious code in http4s-proxy-aget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ce8013404c2d4857d10c30ca8cca41836c76f1021322a394aec4bf792b01945 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...