PT-2019-15179 · Ratpack+1 · Ratpack+1

Jonathan Leitschuh · Publicado 2019-10-18 · Atualizado 2020-08-24 · CVE-2019-17513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ratpack versions 0.9.1 through 1.7.4

Description An issue in Ratpack allows HTTP Response Splitting to occur due to a misuse of the Netty library class DefaultHttpHeaders, where there is no validation that headers lack HTTP control characters. If untrusted data is used to construct HTTP headers with Ratpack, this can happen. An attacker can utilize this vulnerability to have the server issue any HTTP response they specify. The issue affects applications that use arbitrary user input as the value of a response header.

Recommendations For versions 0.9.1 through 1.7.4, update to version 1.7.5 to resolve the issue. As a temporary workaround, consider validating and sanitizing any user-supplied values being used as response headers to prevent HTTP Response Splitting. Avoid using arbitrary user input as response header values until the issue is resolved.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2019-17513

GHSA-MVQP-Q37C-WF9J

Produtos afetados

Netty

Ratpack

Referências · 10

• https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d · Correção
• https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae · Correção
• https://github.com/ratpack/ratpack/releases/tag/v1.7.5 · Nota
• https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j · Nota
• https://github.com/ratpack/ratpack · Nota
• https://ratpack.io/versions/1.7.5 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17513 · Nota de Segurança
• https://github.com/advisories/GHSA-mvqp-q37c-wf9j · Nota
• https://osv.dev/vulnerability/GHSA-mvqp-q37c-wf9j · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-17513 · Aviso do Fabricante