CVE-2020-35884

CVE-2020-35884 affects the Rust tiny_http crate (through 2020-06-16). The issue enables HTTP Request smuggling via a malformed Transfer-Encoding header, as described in the CVE entry. The vulnerability is associated with partial confidentiality and partial integrity impact (per NVD CVSS metrics)....

CVE-2020-35884

An issue was discovered in the tinyhttp crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header...

CVE-2020-35884

An issue was discovered in the tinyhttp crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header...

CVE-2020-35884: Inconsistent Interpretation of HTTP Requests

An issue was discovered in the tinyhttp crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header...

Rust tiny_http crate environmental issue vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. An environmental issue vulnerability exists in tinyhttp crate in versions of Mozilla Rust prior to 2020-06-16, which stems from an HTTP request smuggling can occur via a misformatted transport encoding header. N...

abrute (>=0.1.7, <=0.1.9), alipay-rs (>=0.2.0, <=0.4.6) +57 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.7.0)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.2.0, =0.0.1, =0.1.0, =0.0.1, =0.15.7, =0.1.0, =0.7.0, =0.1.1, =0.1.0, =1.0.0, =3.1.0 - ewer 0.0.2 - fatcat-openapi 0.3.1 and more Source cves: CVE-2020-35884 Source advisory: SNYK:RUST-TINYHTTP-573057...

HTTP Request Smuggling

Overview tinyhttp is a Low level HTTP server library Affected versions of this package are vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling...

abrute (>=0.1.7, <=0.1.9), anterofit (>=0.0.1, <=0.0.2) +15 more potentially affected by CVE-2020-35884 via tiny_http (>=0.4.1, <=0.5.9)

tinyhttp CARGO version =0.4.1, =0.1.7, =0.0.1, =0.0.1, =0.1.1, =0.1.0, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 and more Source cves: CVE-2020-35884 Source advisory: OSV:RUSTSEC-2020-0031...

bevy-contrib-inspector (>=0.1.0, <=0.2.0), cobalt-bin (>=0.16.0, <=0.16.4) +10 more potentially affected by CVE-2020-35884 via tiny_http (0.7.0)

tinyhttp CARGO version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on tinyhttp and may be impacted: - bevy-contrib-inspector =0.1.0, =0.16.0, =0.1.0, =0.9.0, =0.1.0-alpha.0, =0.1.0, =1.1.0, =0.5.1, =0.1.0, =0.2.0, =0.2.1 Source cves:...