Log

AVG-2395 edited at 16 Sep 2021 16:34:02
Severity
- Unknown
+ Medium
CVE-2021-39214 edited at 16 Sep 2021 16:34:02
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Url request injection
Description
+ In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.
+
+ Unless one uses mitmproxy to protect an HTTP/1 service, no action is required.
References
+ https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-22gh-3r9q-xf38
+ https://github.com/mitmproxy/mitmproxy/commit/9fed8ae554a3ba888cc2a9f20f6e8aaa8d8709e7
Notes
AVG-2395 created at 16 Sep 2021 16:32:39
Packages
+ mitmproxy
Issues
+ CVE-2021-39214
Status
- Testing
+ Fixed
Severity
- High
+ Unknown
Affected
- 2.4.48-1
+ 7.0.2-1
Fixed
- 2.4.49-1
+ 7.0.3-1
Ticket
Advisory qualified
Yes
References
Notes
CVE-2021-39214 created at 16 Sep 2021 16:32:39
CVE-2021-33193 edited at 16 Sep 2021 16:30:50
Description
- A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
+ In Apache HTTP Server before version 2.4.49, a crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning.
References
+ https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-33193
https://portswigger.net/research/http2
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c
AVG-2289 edited at 16 Sep 2021 16:30:05
Issues
CVE-2021-33193
+ CVE-2021-34798
+ CVE-2021-36160
+ CVE-2021-39275
+ CVE-2021-40438
Status
- Vulnerable
+ Testing
Severity
- Medium
+ High
Fixed
+ 2.4.49-1
AVG-2395 deleted at 16 Sep 2021 16:29:54
Packages
- apache
Issues
- CVE-2021-33193
- CVE-2021-34798
- CVE-2021-36160
- CVE-2021-39275
- CVE-2021-40438
Status
- Testing
Severity
- High
Affected
- 2.4.48-1
Fixed
- 2.4.49-1
Ticket
Advisory qualified
- Yes
References
Notes
AVG-2395 edited at 16 Sep 2021 16:29:17
Issues
+ CVE-2021-33193
CVE-2021-34798
CVE-2021-36160
CVE-2021-39275
CVE-2021-40438
CVE-2021-39275 edited at 16 Sep 2021 16:28:49
References
- https://httpd.apache.org/security/vulnerabilities_24.html
+ https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
CVE-2021-36160 edited at 16 Sep 2021 16:28:41
References
- https://httpd.apache.org/security/vulnerabilities_24.html
+ https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
CVE-2021-34798 edited at 16 Sep 2021 16:28:32
References
- https://httpd.apache.org/security/vulnerabilities_24.html
+ https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
AVG-2395 edited at 16 Sep 2021 16:28:10
Severity
- Medium
+ High
CVE-2021-40438 edited at 16 Sep 2021 16:28:10
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Url request injection
Description
+ In Apache HTTP Server before version 2.4.49, a crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.
References
+ https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
Notes