PT-2023-18517 · Http4S · Http4S

Highrossabaker · Published 2023-01-04 · Updated 2023-01-11 · CVE-2023-22465

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Http4s versions 0.1.0 through 0.21.33 Http4s versions 0.22.0 through 0.22.14 Http4s versions 0.23.0 through 0.23.16 Http4s versions 1.0.0-M0 through 1.0.0-M37

Description The User-Agent and Server header parsers in Http4s are susceptible to a fatal error on certain inputs. This issue applies to services that explicitly request these typed headers, as modeled headers are lazily parsed in Http4s.

Recommendations For Http4s versions 0.1.0 through 0.21.33, update to version 0.21.34 or later. For Http4s versions 0.22.0 through 0.22.14, update to version 0.22.15 or later. For Http4s versions 0.23.0 through 0.23.16, update to version 0.23.17 or later. For Http4s versions 1.0.0-M0 through 1.0.0-M37, update to version 1.0.0-M38 or later. As a temporary workaround for all affected versions, consider using the weakly typed header interface to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-22465

GHSA-54W6-VXFH-FW7F

Affected Products

Http4S

References · 8

• 🔥 https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22465.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-22465 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22465 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-54w6-vxfh-fw7f · Vendor Advisory
• https://github.com/http4s/http4s · Note
• https://t.me/cvenotify/41777 · Telegram Post
• https://t.me/cibsecurity/55895 · Telegram Post