org.http4s:http4s-blaze-server_2.11 (0.15.4), org.http4s:http4s-jetty_2.11 (0.15.4) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.4)

org.http4s:http4s-server2.11 MAVEN version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.4 - org.http4s:http4s-jetty2.11 0.15.4 -...

org.http4s:http4s-blaze-server_2.11 (0.14.9), org.http4s:http4s-jetty_2.11 (0.14.9) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.14.9)

org.http4s:http4s-server2.11 MAVEN version 0.14.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.14.9 - org.http4s:http4s-jetty2.11 0.14.9 -...

org.http4s:http4s-blaze-server_2.10 (0.14.0), org.http4s:http4s-jetty_2.10 (0.14.0) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.10 (0.14.0)

org.http4s:http4s-server2.10 MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.10 and may be impacted: - org.http4s:http4s-blaze-server2.10 0.14.0 - org.http4s:http4s-jetty2.10 0.14.0 -...

org.http4s:http4s-blaze-server_2.11 (0.15.12), org.http4s:http4s-jetty_2.11 (0.15.12) +3 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.15.12)

org.http4s:http4s-server2.11 MAVEN version 0.15.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.15.12 - org.http4s:http4s-jetty2.11 0.15.12 -...

org.http4s:http4s-blaze-server_2.11 (0.20.15), org.http4s:http4s-jetty_2.11 (0.20.15) +2 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.11 (0.20.15)

org.http4s:http4s-server2.11 MAVEN version 0.20.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4s:http4s-server2.11 and may be impacted: - org.http4s:http4s-blaze-server2.11 0.20.15 - org.http4s:http4s-jetty2.11 0.20.15 -...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

Design/Logic Flaw

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185 Default CORS config allows any origin with credentials

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

com.github.ghostdogpr:caliban-http4s_3 (1.1.1), com.itv:scalapact-http4s-0-23_3 (>=4.0.0-rc1, <=4.2.0) +13 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_3 (>=0.23.0, <=0.23.1)

org.http4s:http4s-server3 MAVEN version =0.23.0, =4.0.0-rc1, =4.0.0-rc1, =1.6.0, =0.19.0-m4, =0.19.0-m4, =0.12.0-rc2+5-dd85de58, =0.12.0-rc2+5-dd85de58, =0.23.0, =0.23.0, =0.23.0, =0.23.0, =0.23.0, =0.23.1 - org.planet42:laika-preview3 0.18.0 Source cves: CVE-2021-39185 Source advisory:...

CVE-2021-39185

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

CVE-2021-39185

Http4s is affected by a vulnerability in the default CORS configuration that enables origin reflection and a Null Origin Attack for versions 0.21.26 and prior, 0.22.0–0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24. The issue stems from the default CORS settings allowing credentialed acces...

com.avast.grpc:grpc-json-bridge-http4s_2.13 (>=0.18.8, <=0.20.0), com.avast:sst-bundle-monix-http4s-blaze_2.13 (>=0.12.0, <=0.12.1) +27 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_2.13 (>=0.22.0, <=0.22.2)

org.http4s:http4s-server2.13 MAVEN version =0.22.0, =0.18.8, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.12.0, =0.5.0-m2, =0.18.1, =0.18.1, =0.0.10, =0.11.0+79-d21ea0df, =0.11.1 and more Source cves: CVE-2021-39185 Source advisory: MEND:CVE-2021-39185...

com.softwaremill.sttp.tapir:tapir-http4s-server_3 (>=0.18.1, <=0.18.3), org.http4s:http4s-blaze-server_3 (>=0.22.0, <=0.22.2) +4 more potentially affected by CVE-2021-39185 via org.http4s:http4s-server_3 (>=0.22.0, <=0.22.2)

org.http4s:http4s-server3 MAVEN version =0.22.0, =0.18.1, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.0, =0.22.2 Source cves: CVE-2021-39185 Source advisory: MEND:CVE-2021-39185...

CVE-2021-39185: Origin Validation Error

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null...

PT-2021-22442

Name of the Vulnerable Software and Affected Versions http4s versions 0.21.26 and prior http4s versions 0.22.0 through 0.22.2 http4s versions 0.23.0 and 0.23.1 http4s versions 1.0.0-M1 through 1.0.0-M24 Description The default CORS configuration in http4s is vulnerable to an origin reflection...

Http4s Access Control Vulnerability

http4s is an open source streaming HTTP server for Scala. An access control error vulnerability exists in Http4s that stems from the default CORS configuration being vulnerable to source reflection attacks. The following products and versions are affected: 0.21.26 and earlier, 0.22.0 through...

GHSA-6H7W-FC84-X7P6 StaticFile.fromUrl can leak presence of a directory

Impact StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a directory, without first checking the...

StaticFile.fromUrl can leak presence of a directory

Impact StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a directory, without first checking the...