PT-2023-18517 · Http4S · Http4S

Highrossabaker · Publicado 2023-01-04 · Atualizado 2023-01-11 · CVE-2023-22465

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Http4s versions 0.1.0 through 0.21.33 Http4s versions 0.22.0 through 0.22.14 Http4s versions 0.23.0 through 0.23.16 Http4s versions 1.0.0-M0 through 1.0.0-M37

Description The User-Agent and Server header parsers in Http4s are susceptible to a fatal error on certain inputs. This issue applies to services that explicitly request these typed headers, as modeled headers are lazily parsed in Http4s.

Recommendations For Http4s versions 0.1.0 through 0.21.33, update to version 0.21.34 or later. For Http4s versions 0.22.0 through 0.22.14, update to version 0.22.15 or later. For Http4s versions 0.23.0 through 0.23.16, update to version 0.23.17 or later. For Http4s versions 1.0.0-M0 through 1.0.0-M37, update to version 1.0.0-M38 or later. As a temporary workaround for all affected versions, consider using the weakly typed header interface to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-22465

GHSA-54W6-VXFH-FW7F

Produtos afetados

Http4S

Referências · 8

• 🔥 https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22465.json · Exploit
• https://github.com/http4s/http4s · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-22465 · Nota de Segurança
• https://t.me/cvenotify/41777 · Publicação no Telegram
• https://t.me/cibsecurity/55895 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-22465 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-54w6-vxfh-fw7f · Aviso do Fabricante