CVE-2020-5280 Local file inclusion vulnerability in http4s

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

CVE-2020-5280

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...

Local file inclusion vulnerability in http4s

Impact This vulnerability applies to all users of: org.http4s.server.staticcontent.FileService org.http4s.server.staticcontent.ResourceService org.http4s.server.staticcontent.WebjarService Path escaping URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expos...

com.dbrsn:universal-health-check-http4s_2.12 (0.0.5), com.github.agourlay:cornichon-http-mock_2.12 (>=0.12.7, <=0.16.3) +38 more potentially affected by CVE-2020-5280 via org.http4s:http4s-server_2.12 (>=0.10.0-m10, <=0.18.25)

org.http4s:http4s-server2.12 MAVEN version =0.10.0-m10, =0.12.7, =0.0.3, =0.1, =0.1.0-rc2, =0.5.0, =2.1.0, =2.2.0, =2.2.0, =2.2.0, =2.3.0-rc1, =2.2.0, =2.3.0-rc1, =2.2.2, =2.2.5 and more Source cves: CVE-2020-5280 Source advisory: OSV:GHSA-66Q9-F7FF-MMX6...

com.avast:sst-bundle-monix-http4s-blaze_2.12 (>=0.1.21, <=0.1.29), com.avast:sst-bundle-zio-http4s-blaze_2.12 (>=0.1.21, <=0.1.29) +34 more potentially affected by CVE-2020-5280 via org.http4s:http4s-server_2.12 (>=0.21.0, <=0.21.1)

org.http4s:http4s-server2.12 MAVEN version =0.21.0, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.1.21, =0.2.0.2, =0.2.1-ct-2 and more Source cves: CVE-2020-5280 Source advisory: OSV:GHSA-66Q9-F7FF-MMX6...

GHSA-66Q9-F7FF-MMX6 Local file inclusion vulnerability in http4s

Impact This vulnerability applies to all users of: org.http4s.server.staticcontent.FileService org.http4s.server.staticcontent.ResourceService org.http4s.server.staticcontent.WebjarService Path escaping URI normalization is applied incorrectly. Requests whose path info contain ../ or // can expos...

PT-2020-18370

Name of the Vulnerable Software and Affected Versions http4s versions prior to 0.18.26 http4s versions prior to 0.20.20 http4s versions prior to 0.21.2 Description The issue applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService, and...

CVE-2020-5280: Relative Path Traversal

http4s before versions 0.18.26, 0.20.20, and 0.21.2 has a local file inclusion vulnerability. This vulnerability applies to all users of org.http4s.server.staticcontent.FileService, org.http4s.server.staticcontent.ResourceService and org.http4s.server.staticcontent.WebjarService. URI normalizatio...