PT-2017-15154 · Crate · Hyper

Published 2017-01-23 · Updated 2021-08-25 · CVE-2017-18587

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions hyper crate versions prior to 0.9.18

Description The issue concerns the mishandling of newlines in headers, specifically that serializing of headers to the socket did not filter the values for newline bytes (r or ), allowing for header values to split a request or response. This could be exploited if an application constructs headers based on unsanitized user input. The issue was fixed by replacing all newline characters with a space during serialization of a header value.

Recommendations For versions prior to 0.9.18, update to version 0.9.18 or later to resolve the issue. As a temporary workaround, consider sanitizing user input used in constructing headers to prevent the inclusion of newline characters. Restrict access to applications that construct headers based on user input to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2017-18587

GHSA-Q89X-F52W-6HJ2

RUSTSEC-2017-0002

Affected Products

Hyper

References · 8

• https://osv.dev/vulnerability/CVE-2017-18587 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18587 · Security Note
• https://osv.dev/vulnerability/GHSA-q89x-f52w-6hj2 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2017-0002 · Vendor Advisory
• https://github.com/hyperium/hyper/wiki/Security-001 · Note
• https://github.com/hyperium/hyper · Note
• https://rustsec.org/advisories/RUSTSEC-2017-0002.html · Note
• https://crates.io/crates/hyper · Note