PT-2021-15443 · Lightbend · Akka-Http-Core

Bastian Ike + 2 · Published 2021-02-17 · Updated 2021-05-10 · CVE-2021-23339

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions com.typesafe.akka:akka-http-core versions prior to 10.1.14 com.typesafe.akka:akka-http-core versions 10.2.0 through 10.2.4

Description The issue allows multiple Transfer-Encoding headers, which can lead to a malformed message being accepted by a vulnerable Akka HTTP server. If this message is proxied to another server without inspection, it may be interpreted as two HTTP messages, potentially bypassing security checks.

Recommendations For versions prior to 10.1.14, update to version 10.1.14 or later. For versions 10.2.0 through 10.2.4, update to a version later than 10.2.4. As a temporary workaround, consider restricting the acceptance of multiple Transfer-Encoding headers in the Akka HTTP server configuration until a patch is available.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-23339

GHSA-2W7W-2J92-44HX

SNYK-JAVA-COMTYPESAFEAKKA-1075043

Affected Products

Akka-Http-Core

References · 7

• https://osv.dev/vulnerability/GHSA-2w7w-2j92-44hx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23339 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23339 · Security Note
• https://github.com/akka/akka-http/pull/3754%23issuecomment-779265201 · Note
• https://github.com/akka/akka-http/commit/e3a4935151c91cee28e65e6b894dd50839ef9d34 · Note
• https://snyk.io/vuln/SNYK-JAVA-COMTYPESAFEAKKA-1075043 · Note
• https://doc.akka.io/docs/akka-http/10.1/security/2021-02-24-incorrect-handling-of-Transfer-Encoding-header.html · Note