HTTP Request Smuggling (HRS)

mitmproxy is vulnerable to HTTP request smuggling. The vulnerability is due to mitmproxy embedding python-hyper/h2 ≤ v4.2.0 which has a gap in its HTTP/2 header validation, which allows an attacker to smuggle requests when mitmproxy translates HTTP/2 to HTTP/1...

Linux Distros Unpatched Vulnerability : CVE-2018-14505

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. CVE-2018-14505 Note that Nessus relies on the presence of the package as...

eavesdropper (>=0.0.1, <=0.0.5), goth (>=0.1.0, <=0.16.0) +3 more potentially affected by unknown CVE via mitmproxy (5.3.0)

mitmproxy PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - eavesdropper =0.0.1, =0.1.0, =0.16.0 - http-tools 2.0.0 - iiintent 0.42.11 - mitm-chrome 0.1.1 Source cves: unknown CVE Source advisory:...

proxydns (>=0.0.2, <=0.0.5), wapiti3 (>=3.2.5, <=3.2.6) potentially affected by unknown CVE via mitmproxy (>=12.0.0, <=12.1.1)

mitmproxy PYPI version =12.0.0, =0.0.2, =3.2.5, =3.2.6 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

GHSA-63CX-G855-HVV4 mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

mitmproxy 12.1.1 and below embed python-hyper/h2 ≤ v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to http:// backends. It does not...

proxydns (>=0.0.2, <=0.0.5), wapiti3 (>=3.2.5, <=3.2.6) potentially affected by unknown CVE via mitmproxy (>=12.0.0, <=12.1.1)

mitmproxy PYPI version =12.0.0, =0.0.2, =3.2.5, =3.2.6 Source cves: unknown CVE Source advisory: GHSA-63CX-G855-HVV4...

codex-watch (0.1.1), hippolyzer (>=0.0.0, <=0.16.4) +8 more potentially affected by unknown CVE via mitmproxy (11.1.3)

mitmproxy PYPI version 11.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - codex-watch 0.1.1 - hippolyzer =0.0.0, =0.14.1a0, =0.2.0, =0.1.8, =0.1.0, =0.1.22 - wapiti3 3.2.4 Source cves: unknown CVE Source advisory:...

cloudflyer (>=1.0.2, <=1.0.5), jdcat (>=1.0.0, <=1.3.0) +2 more potentially affected by unknown CVE via mitmproxy (11.0.2)

mitmproxy PYPI version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - cloudflyer =1.0.2, =1.0.0, =1.1.0, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

http-tools (5.0.0), octotail (>=1.0.0, <=1.0.13) potentially affected by unknown CVE via mitmproxy (11.0.0)

mitmproxy PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - http-tools 5.0.0 - octotail =1.0.0, =1.0.13 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

kraken-build (>=0.34.0, <=0.35.3), kraken-wrapper (>=0.33.2, <=0.35.3) +4 more potentially affected by unknown CVE via mitmproxy (10.4.2)

mitmproxy PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - kraken-build =0.34.0, =0.33.2, =0.11.0, =0.0.2, =0.0.1, =0.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

halborn-ctf (>=0.1.0, <=0.1.20) potentially affected by unknown CVE via mitmproxy (10.3.0)

mitmproxy PYPI version 10.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - halborn-ctf =0.1.0, =0.1.20 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

uproxier (>=0.1.0, <=0.2.0) potentially affected by unknown CVE via mitmproxy (10.2.4)

mitmproxy PYPI version 10.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - uproxier =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

robotframework-mitmlibrary (0.1.3), wapiti3 (>=3.2.0, <=3.2.3) potentially affected by unknown CVE via mitmproxy (10.2.3)

mitmproxy PYPI version 10.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - robotframework-mitmlibrary 0.1.3 - wapiti3 =3.2.0, =3.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

clotho (0.1.0) potentially affected by unknown CVE via mitmproxy (10.2.2)

mitmproxy PYPI version 10.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - clotho 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

http-tools (4.0.0) potentially affected by unknown CVE via mitmproxy (10.1.5)

mitmproxy PYPI version 10.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - http-tools 4.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

aomaker (>=2.4.11, <=2.4.13), apidriver (0.9.5) +14 more potentially affected by unknown CVE via mitmproxy (9.0.1)

mitmproxy PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - aomaker =2.4.11, =0.1.0a0, =0.32.0, =0.32.0, =0.32.0, =0.32.0, =0.3.0, =0.7.2, =0.0.22, =0.3.0, =0.4.2 and more Source cves: unknown CVE Sourc...

stoobly-agent (>=0.11.4, <=0.34.13) potentially affected by unknown CVE via mitmproxy (8.1.0)

mitmproxy PYPI version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - stoobly-agent =0.11.4, =0.34.13 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

garbevents (2.0.9), hippolyzer (>=0.7.0, <=0.9.0) +3 more potentially affected by unknown CVE via mitmproxy (7.0.4)

mitmproxy PYPI version 7.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - garbevents 2.0.9 - hippolyzer =0.7.0, =1.1.1, =0.2.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

hippolyzer (>=0.2.0, <=0.6.3), mitm-chrome (0.1.2) +2 more potentially affected by unknown CVE via mitmproxy (6.0.2)

mitmproxy PYPI version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - hippolyzer =0.2.0, =0.1.6, =0.11.3 - xepor 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...

comics-down (0.2.0), http-tools (1.1.0) potentially affected by unknown CVE via mitmproxy (5.0.1)

mitmproxy PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - comics-down 0.2.0 - http-tools 1.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-63CX-G855-HVV4...