PT-2021-6447 · Hyper · Hyper

Asta Olofsson + 1 · Published 2021-07-07 · Updated 2021-07-22 · CVE-2021-32715

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions hyper versions prior to 0.14.10

Description The issue is related to the incorrect parsing and acceptance of requests with a Content-Length header containing a prefixed plus sign. This can lead to "request smuggling" or "desync attacks" when combined with an upstream HTTP proxy that does not parse such headers but forwards them. The estimated likelihood of an attack exploiting this vulnerability is considered low due to the specific conditions required.

Recommendations For versions prior to 0.14.10, consider the following workarounds:

• Reject requests manually that contain a plus sign prefix in the Content-Length header.
• Ensure any upstream proxy handles Content-Length headers with a plus sign prefix. For a permanent fix, update to version 0.14.10 or later.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2022-01647

CVE-2021-32715

GHSA-F3PG-QWVG-P99C

OPENSUSE-SU-2024:11751-1

RUSTSEC-2021-0078

Affected Products

Hyper

References · 16

• 🔥 https://github.com/hyperium/hyper/security/advisories/GHSA-f3pg-qwvg-p99c · Exploit
• https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-32715 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f3pg-qwvg-p99c · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32715 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32715 · Security Note
• https://ubuntu.com/security/CVE-2021-32715 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0078 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32715 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32715 · Security Note
• https://bdu.fstec.ru/vul/2022-01647 · Security Note
• https://github.com/hyperium/hyper/commit/1fb719e0b61a4f3d911562a436a2ff05fd7cb759 · Note
• https://github.com/hyperium/hyper · Note
• https://crates.io/crates/hyper · Note