PT-2019-15179 · Ratpack+1 · Ratpack+1

Jonathan Leitschuh · Published 2019-10-18 · Updated 2020-08-24 · CVE-2019-17513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ratpack versions 0.9.1 through 1.7.4

Description An issue in Ratpack allows HTTP Response Splitting to occur due to a misuse of the Netty library class DefaultHttpHeaders, where there is no validation that headers lack HTTP control characters. If untrusted data is used to construct HTTP headers with Ratpack, this can happen. An attacker can utilize this vulnerability to have the server issue any HTTP response they specify. The issue affects applications that use arbitrary user input as the value of a response header.

Recommendations For versions 0.9.1 through 1.7.4, update to version 1.7.5 to resolve the issue. As a temporary workaround, consider validating and sanitizing any user-supplied values being used as response headers to prevent HTTP Response Splitting. Avoid using arbitrary user input as response header values until the issue is resolved.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2019-17513

GHSA-MVQP-Q37C-WF9J

Affected Products

Netty

Ratpack

References · 10

• https://github.com/ratpack/ratpack/commit/efb910d38a96494256f36675ef0e5061097dd77d · Patch
• https://github.com/ratpack/ratpack/commit/c560a8d10cb8bdd7a526c1ca2e67c8f224ca23ae · Patch
• https://ratpack.io/versions/1.7.5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17513 · Security Note
• https://osv.dev/vulnerability/GHSA-mvqp-q37c-wf9j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17513 · Vendor Advisory
• https://github.com/ratpack/ratpack/releases/tag/v1.7.5 · Note
• https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j · Note
• https://github.com/ratpack/ratpack · Note
• https://github.com/advisories/GHSA-mvqp-q37c-wf9j · Note