MAL-2022-3701 Malicious code in http4s-proxy-aget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ce8013404c2d4857d10c30ca8cca41836c76f1021322a394aec4bf792b01945 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hash collision in typelevel jawn

Impact Extenders of the org.typelevel.jawn.SimpleFacade and org.typelevel.jawn.MutableFacade who don't override objectContext are vulnerable to a hash collision attack. Most applications do not implement these traits directly, but inherit from a library: Affected implementations include: org.http...

ch.j3t:zio-prefetcher_2.12 (>=0.3.0, <=0.6.0), com.akolov:doorman-core_2.12 (0.0.5) +166 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-server2.12 MAVEN version =0.10.0-m10, =0.3.0, =0.3.0, =0.18.1, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.0.6-m4, =0.0.6-m4, =0.0.6 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.47deg:embedded-cassandra-core_2.12 (0.0.7), com.47deg:github4s_2.12 (>=0.22.0, <=0.28.5) +206 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.12 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-client2.12 MAVEN version =0.10.0-m10, =0.22.0, =0.13.2, =0.2.6, =0.3.0, =0.2.0, =0.1.0, =0.1.4, =0.1.4, =0.1.4, =0.1.4, =0.1.11, =0.11.3 - com.azavea.geotrellis:geotrellis-server-stac-example2.12 4.4.0 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.github.ghostdogpr:caliban-http4s_2.12 (1.1.1), com.iheart:thomas-http4s_2.12 (>=1.2.0, <=1.3.9) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server2.12 MAVEN version =0.23.0, =1.2.0, =1.2.0, =1.2.0, =3.3.2, =3.3.2, =0.19.0-m4, =0.19.0-m4, =0.0.1, =0.12.0-rc2+5-dd85de58, =0.12.0 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

ch.epfl.bluebrain.nexus:cli_2.13 (>=1.5.0-rc4, <=1.6.1), com.47deg:github4s_2.13 (>=0.22.0, <=0.28.5) +169 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.10.0-m10, <=0.21.28)

org.http4s:http4s-client2.13 MAVEN version =0.10.0-m10, =1.5.0-rc4, =0.22.0, =0.2.0, =0.2.0, =0.1.0, =1.3.1, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =6.0.0-m1, =0.0.38, =0.0.38, =0.0.38, =0.1.0.1 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.avast.grpc:grpc-json-bridge-http4s_2.12 (>=0.18.8, <=0.20.0), com.avast:sst-bundle-monix-http4s-blaze_2.12 (>=0.12.0, <=0.12.2) +26 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server2.12 MAVEN version =0.22.0, =0.18.8, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =0.18.1, =0.18.1, =0.11.0+79-d21ea0df, =0.11.0+79-d21ea0df, =0.11.1 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.github.ghostdogpr:caliban-http4s_3 (1.1.1), com.itv:scalapact-http4s-0-23_3 (>=4.0.0-rc1, <=4.2.0) +13 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_3 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server3 MAVEN version =0.23.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.19.0-m4, =0.19.0-m4, =0.12.0-rc2+5-dd85de58, =0.12.0-rc2+5-dd85de58, =0.23.0, =0.23.0, =0.23.0, =0.23.0, =0.23.0, =0.23.3 - org.planet42:laika-preview3 0.18.0 Source cves: CVE-2021-41084 Source advisory:...

com.alejandrohdezma:http4s-munit-testcontainers_2.13 (0.8.0), com.alejandrohdezma:http4s-munit_2.13 (0.8.0) +31 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.13 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =0.0.10, =0.1.2 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.alejandrohdezma:http4s-munit-testcontainers_2.12 (0.8.0), com.alejandrohdezma:http4s-munit_2.12 (0.8.0) +29 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.12 (>=0.22.0, <=0.22.4)

org.http4s:http4s-client2.12 MAVEN version =0.22.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =4.1.0, =3.3.12, =3.17.8.2, =3.17.42.2 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.gaborpihaj:http4s-jwt-auth-middleware_2.11 (0.1.0), com.github.agourlay:cornichon-http-mock_2.11 (>=0.12.7, <=0.16.1) +65 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.11 (>=0.2.0, <=0.21.0-m1)

org.http4s:http4s-server2.11 MAVEN version =0.2.0, =0.12.7, =0.0.3, =0.0.3-pre, =0.0.1-pre, =1.1.0, =0.1, =0.1.0-rc2, =1.0.4, =1.0.12 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.47deg:github4s_3 (>=0.29.1, <=0.30.0), com.banno:vault4s_3 (9.0.0) +27 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_3 (>=0.23.0, <=0.23.3)

org.http4s:http4s-client3 MAVEN version =0.23.0, =0.29.1, =0.8.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.9.0-m5, =3.3.13, =0.18.3, =0.1.0, =0.1.0, =0.3.2 - io.janstenpickle:trace4cats-datadog-http-exporter3 0.12.0 - io.janstenpickle:trace4cats-exporter-http3 0.12.0 and more Source cves: CVE-2021-4108...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.4) +4 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.4 Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

Response Splitting from unsanitized headers

Impact http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names Header.nameå Header values Header.value Status reason phrases Status.reason URI paths Uri.Path URI authority registered names...

com.groupon.sparklint:sparklint-spark160_2.10 (>=1.0.4, <=1.0.12), com.groupon.sparklint:sparklint-spark161_2.10 (>=1.0.4, <=1.0.12) +27 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.10 (>=0.2.0, <=0.16.6a)

org.http4s:http4s-server2.10 MAVEN version =0.2.0, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.5, =1.0.8, =1.0.9, =1.0.9, =1.0.9, =1.0.0, =2.2.0, =2.2.0, =2.2.5 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.avast.grpc:grpc-json-bridge-http4s_2.13 (>=0.18.8, <=0.20.0), com.avast:sst-bundle-monix-http4s-blaze_2.13 (>=0.12.0, <=0.12.2) +28 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.13 (>=0.22.0, <=0.22.4)

org.http4s:http4s-server2.13 MAVEN version =0.22.0, =0.18.8, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.5.0-m2, =4.1.0, =0.18.1, =0.18.1, =0.0.10, =0.1.2 - io.github.apimorphism:telegramium-high2.13 6.53.0 and more Source cves: CVE-2021-41084 Source advisory: GHSA-5VCM-3XC3-W7X3...

com.busymachines:pureharm-route-http4s-tapir_2.13 (>=0.5.0-m2, <=0.5-11-334582e), com.github.ghostdogpr:caliban-http4s_2.13 (1.1.1) +33 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.13 (>=0.23.0, <=0.23.3)

org.http4s:http4s-server2.13 MAVEN version =0.23.0, =0.5.0-m2, =1.2.2, =1.2.2, =1.2.2, =3.3.2, =3.3.2, =0.19.0-m4, =0.19.0-m4, =0.0.1, =0.2.0 - dev.profunktor:http4s-jwt-auth2.13 1.0.0 - io.chrisdavenport:mules-http4s2.13 0.3.0-m1 - io.github.apimorphism:telegramium-high2.13 7.53.0 -...

com.groupon.sparklint:sparklint-spark160_2.10 (>=1.0.4, <=1.0.12), com.groupon.sparklint:sparklint-spark161_2.10 (>=1.0.4, <=1.0.12) +27 more potentially affected by CVE-2021-41084 via org.http4s:http4s-server_2.10 (>=0.2.0, <=0.16.6a)

org.http4s:http4s-server2.10 MAVEN version =0.2.0, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.4, =1.0.5, =1.0.8, =1.0.9, =1.0.9, =1.0.9, =1.0.0, =2.2.0, =2.2.0, =2.2.5 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.47deg:github4s_2.13 (>=0.29.1, <=0.30.0), com.banno:vault4s_2.13 (9.0.0) +44 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_2.13 (>=0.23.0, <=0.23.3)

org.http4s:http4s-client2.13 MAVEN version =0.23.0, =0.29.1, =0.7.0, =1.2.2, =3.3.2, =3.3.2, =0.9.0-m5, =0.18.0-rc1, =3.3.13, =0.18.3, =0.3.0, =0.3.1 - io.chrisdavenport:mules-http4s2.13 0.3.0-m1 and more Source cves: CVE-2021-41084 Source advisory: OSV:GHSA-5VCM-3XC3-W7X3...

com.47deg:github4s_3 (>=0.29.1, <=0.30.0), com.banno:vault4s_3 (9.0.0) +27 more potentially affected by CVE-2021-41084 via org.http4s:http4s-client_3 (>=0.23.0, <=0.23.3)

org.http4s:http4s-client3 MAVEN version =0.23.0, =0.29.1, =0.8.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.9.0-m5, =3.3.13, =0.18.3, =0.1.0, =0.1.0, =0.3.2 - io.janstenpickle:trace4cats-datadog-http-exporter3 0.12.0 - io.janstenpickle:trace4cats-exporter-http3 0.12.0 and more Source cves: CVE-2021-4108...