Add hyper request smuggling vulnerability #255
Conversation
|
Thanks for the report! Please remove all the comments in the file (anything starting with Also, I'd describe the effect as privilege escalation or ACL bypass. You need some other component to be vulnerable to get code execution. |
Also make some trivial changes to pass the linter.
|
Per @Shnatsel's comment on hyperium/hyper#1925 I'll leave this PR open briefly to collect any additional comments or review |
|
Assigned |
| The flaw was corrected in hyper version 0.12.35. | ||
| """ | ||
|
|
||
| [versions] | ||
| patched = [">= 0.12.35"] |
There was a problem hiding this comment.
I believe the version listed here is incorrect; the vulnerability was fixed in 0.12.34.
|
Are versions prior to 0.11 affected? |
|
Versions below 0.11 are not affected. The advisory was later updated with this info: https://github.com/RustSec/advisory-db/blob/master/crates/hyper/RUSTSEC-2020-0008.toml |
|
Looks like https://rustsec.org/advisories/RUSTSEC-2020-0008.html hasn't been updated though. |
|
Should be updated now. Sorry about that. (I should really look into automating the web site generation with GitHub Actions) |
No description provided.