CVE-2020-7622

CVE-2020-7622 affects io.jooby:jooby-netty before 1.6.9 and before 2.2.1, where DefaultHttpHeaders is set to false and header validation is disabled, enabling HTTP Response Splitting as described in public advisories. Exploitation status is not provided in the docs. Impact is a potential for abus...

CVE-2020-7622

This affects the package io.jooby:jooby-netty before 1.6.9, from 2.0.0 and before 2.2.1. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting...

GHSA-GV3V-92V6-M48J Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)

Impact - Cross Site Scripting - Cache Poisoning - Page Hijacking Patches This was fixed in version 2.2.1. Workarounds If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters. References CWE-113: Improper...

Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)

Impact - Cross Site Scripting - Cache Poisoning - Page Hijacking Patches This was fixed in version 2.2.1. Workarounds If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters. References CWE-113: Improper...

PT-2020-19659

Name of the Vulnerable Software and Affected Versions io.jooby:jooby-netty versions 1.6.9 and earlier, versions 2.0.0 through 2.2.0 Description This issue affects the DefaultHttpHeaders setting, which is set to false, allowing potential abuse for HTTP Response Splitting. The vulnerability can lea...

HTTP Response Splitting

Overview io.jooby:jooby-netty is a netty implementation in jooby Affected versions of this package are vulnerable to HTTP Response Splitting. The DefaultHttpHeaders is set to false which means it does not validates that the header isn't being abused for HTTP Response Splitting. Remediation Upgrad...

io.skullabs.kikaha:kikaha-core (>=2.0.0-beta1, <=2.0.0-beta4), io.skullabs.kikaha:kikaha-db (>=2.0.0-beta1, <=2.0.0-beta4) +11 more potentially affected by CVE-2019-10212 via io.undertow:undertow-core (1.3.20.final)

io.undertow:undertow-core MAVEN version 1.3.20.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.skullabs.kikaha:kikaha-core =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1,...

GHSA-F5F4-M7QP-W6GC Cross-site Scripting in Jooby

Jooby before 1.6.4 has XSS via the default error handler...

Cross-site Scripting in Jooby

Jooby before 1.6.4 has XSS via the default error handler...

org.jooby:jooby-hbm (0.1.0), org.jooby:jooby-hbs (0.1.0) +3 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.1.0)

org.jooby:jooby MAVEN version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.1.0 - org.jooby:jooby-hbs 0.1.0 - org.jooby:jooby-jackson 0.1.0 - org.jooby:jooby-jdbc 0.1.0 -...

org.jooby:jooby-hbm (0.2.0), org.jooby:jooby-hbs (0.2.0) +2 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.2.0)

org.jooby:jooby MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.2.0 - org.jooby:jooby-hbs 0.2.0 - org.jooby:jooby-jackson 0.2.0 - org.jooby:jooby-jdbc 0.2.0 Source cves:...

org.jooby:jooby-hbm (0.2.1), org.jooby:jooby-hbs (0.2.1) +2 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.2.1)

org.jooby:jooby MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.2.1 - org.jooby:jooby-hbs 0.2.1 - org.jooby:jooby-jackson 0.2.1 - org.jooby:jooby-jdbc 0.2.1 Source cves:...

org.jooby:jooby-hbm (0.3.0), org.jooby:jooby-hbs (0.3.0) +2 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.3.0)

org.jooby:jooby MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.3.0 - org.jooby:jooby-hbs 0.3.0 - org.jooby:jooby-jackson 0.3.0 - org.jooby:jooby-jdbc 0.3.0 Source cves:...

org.jooby:jooby-hbm (0.4.0), org.jooby:jooby-hbs (0.4.0) +2 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.4.0)

org.jooby:jooby MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.4.0 - org.jooby:jooby-hbs 0.4.0 - org.jooby:jooby-jackson 0.4.0 - org.jooby:jooby-jdbc 0.4.0 Source cves:...

org.jooby:jooby-hbm (0.4.1), org.jooby:jooby-hbs (0.4.1) +2 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.4.1)

org.jooby:jooby MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.4.1 - org.jooby:jooby-hbs 0.4.1 - org.jooby:jooby-jackson 0.4.1 - org.jooby:jooby-jdbc 0.4.1 Source cves:...

org.jooby:jooby-hbm (0.4.2), org.jooby:jooby-hbs (0.4.2) +2 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.4.2)

org.jooby:jooby MAVEN version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.4.2 - org.jooby:jooby-hbs 0.4.2 - org.jooby:jooby-jackson 0.4.2 - org.jooby:jooby-jdbc 0.4.2 Source cves:...

org.jooby:jooby-hbm (0.4.2.1), org.jooby:jooby-hbs (0.4.2.1) +2 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.4.2.1)

org.jooby:jooby MAVEN version 0.4.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:jooby-hbm 0.4.2.1 - org.jooby:jooby-hbs 0.4.2.1 - org.jooby:jooby-jackson 0.4.2.1 - org.jooby:jooby-jdbc 0.4.2.1 Sour...

org.jooby:coverage-report (0.5.0), org.jooby:jooby-camel (0.5.0) +14 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.5.0)

org.jooby:jooby MAVEN version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:coverage-report 0.5.0 - org.jooby:jooby-camel 0.5.0 - org.jooby:jooby-ftl 0.5.0 - org.jooby:jooby-hbm 0.5.0 -...

org.jooby:coverage-report (0.5.1), org.jooby:jooby-camel (0.5.1) +14 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.5.1)

org.jooby:jooby MAVEN version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:coverage-report 0.5.1 - org.jooby:jooby-camel 0.5.1 - org.jooby:jooby-ftl 0.5.1 - org.jooby:jooby-hbm 0.5.1 -...

org.jooby:coverage-report (0.5.2), org.jooby:jooby-camel (0.5.2) +14 more potentially affected by CVE-2019-15477 via org.jooby:jooby (0.5.2)

org.jooby:jooby MAVEN version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jooby:jooby and may be impacted: - org.jooby:coverage-report 0.5.2 - org.jooby:jooby-camel 0.5.2 - org.jooby:jooby-ftl 0.5.2 - org.jooby:jooby-hbm 0.5.2 -...