CVE Vulnerabilities

CVE-2021-41084

Server-Side Request Forgery (SSRF)

Published: Sep 21, 2021 | Modified: Nov 21, 2024
CVSS 3.x
4.7
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or request-splitting attacks when untrusted user input is used to create any of the following fields: Header names (Header.nameå), Header values (Header.value), Status reason phrases (Status.reason), URI paths (Uri.Path), URI authority registered names (URI.RegName) (through 0.21). This issue has been resolved in versions 0.21.30, 0.22.5, 0.23.4, and 1.0.0-M27 perform the following. As a matter of practice http4s services and client applications should sanitize any user input in the aforementioned fields before returning a request or response to the backend. The carriage return, newline, and null characters are the most threatening.

Weakness

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Software

Name Vendor Start Version End Version
Http4s Typelevel * 0.21.29 (excluding)
Http4s Typelevel 0.22.0 (including) 0.22.5 (excluding)
Http4s Typelevel 0.23.0 (including) 0.23.4 (excluding)
Http4s Typelevel 1.0.0-milestone1 (including) 1.0.0-milestone1 (including)
Http4s Typelevel 1.0.0-milestone10 (including) 1.0.0-milestone10 (including)
Http4s Typelevel 1.0.0-milestone11 (including) 1.0.0-milestone11 (including)
Http4s Typelevel 1.0.0-milestone12 (including) 1.0.0-milestone12 (including)
Http4s Typelevel 1.0.0-milestone13 (including) 1.0.0-milestone13 (including)
Http4s Typelevel 1.0.0-milestone14 (including) 1.0.0-milestone14 (including)
Http4s Typelevel 1.0.0-milestone15 (including) 1.0.0-milestone15 (including)
Http4s Typelevel 1.0.0-milestone16 (including) 1.0.0-milestone16 (including)
Http4s Typelevel 1.0.0-milestone17 (including) 1.0.0-milestone17 (including)
Http4s Typelevel 1.0.0-milestone18 (including) 1.0.0-milestone18 (including)
Http4s Typelevel 1.0.0-milestone19 (including) 1.0.0-milestone19 (including)
Http4s Typelevel 1.0.0-milestone2 (including) 1.0.0-milestone2 (including)
Http4s Typelevel 1.0.0-milestone20 (including) 1.0.0-milestone20 (including)
Http4s Typelevel 1.0.0-milestone21 (including) 1.0.0-milestone21 (including)
Http4s Typelevel 1.0.0-milestone22 (including) 1.0.0-milestone22 (including)
Http4s Typelevel 1.0.0-milestone23 (including) 1.0.0-milestone23 (including)
Http4s Typelevel 1.0.0-milestone24 (including) 1.0.0-milestone24 (including)
Http4s Typelevel 1.0.0-milestone25 (including) 1.0.0-milestone25 (including)
Http4s Typelevel 1.0.0-milestone26 (including) 1.0.0-milestone26 (including)
Http4s Typelevel 1.0.0-milestone3 (including) 1.0.0-milestone3 (including)
Http4s Typelevel 1.0.0-milestone4 (including) 1.0.0-milestone4 (including)
Http4s Typelevel 1.0.0-milestone5 (including) 1.0.0-milestone5 (including)
Http4s Typelevel 1.0.0-milestone6 (including) 1.0.0-milestone6 (including)
Http4s Typelevel 1.0.0-milestone7 (including) 1.0.0-milestone7 (including)
Http4s Typelevel 1.0.0-milestone8 (including) 1.0.0-milestone8 (including)
Http4s Typelevel 1.0.0-milestone9 (including) 1.0.0-milestone9 (including)

References