5.8

CVE-2021-32643

StaticFile.fromUrl can leak presence of a directory

Http4s is a Scala interface for HTTP services. `StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority. The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL. If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response. The contents and other metadata about the directory are not exposed. This affects http4s versions: 0.21.7 through 0.21.23, 0.22.0-M1 through 0.22.0-M8, 0.23.0-M1, and 1.0.0-M1 through 1.0.0-M22. The [patch](https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9) is available in the following versions: v0.21.24, v0.22.0-M9, v0.23.0-M2, v1.0.0-M23. As a workaround users can avoid calling `StaticFile.fromUrl` with non-file URLs.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Typelevel ≫ Http4s Version >= 0.21.7 < 0.21.24
Typelevel ≫ Http4s Version 0.22.0 Update milestone1
Typelevel ≫ Http4s Version 0.22.0 Update milestone2
Typelevel ≫ Http4s Version 0.22.0 Update milestone3
Typelevel ≫ Http4s Version 0.22.0 Update milestone4
Typelevel ≫ Http4s Version 0.22.0 Update milestone5
Typelevel ≫ Http4s Version 0.22.0 Update milestone6
Typelevel ≫ Http4s Version 0.22.0 Update milestone7
Typelevel ≫ Http4s Version 0.22.0 Update milestone8
Typelevel ≫ Http4s Version 0.23.0 Update milestone1
Typelevel ≫ Http4s Version 1.0.0 Update milestone1
Typelevel ≫ Http4s Version 1.0.0 Update milestone10
Typelevel ≫ Http4s Version 1.0.0 Update milestone11
Typelevel ≫ Http4s Version 1.0.0 Update milestone12
Typelevel ≫ Http4s Version 1.0.0 Update milestone13
Typelevel ≫ Http4s Version 1.0.0 Update milestone14
Typelevel ≫ Http4s Version 1.0.0 Update milestone15
Typelevel ≫ Http4s Version 1.0.0 Update milestone16
Typelevel ≫ Http4s Version 1.0.0 Update milestone17
Typelevel ≫ Http4s Version 1.0.0 Update milestone18
Typelevel ≫ Http4s Version 1.0.0 Update milestone19
Typelevel ≫ Http4s Version 1.0.0 Update milestone2
Typelevel ≫ Http4s Version 1.0.0 Update milestone20
Typelevel ≫ Http4s Version 1.0.0 Update milestone21
Typelevel ≫ Http4s Version 1.0.0 Update milestone22
Typelevel ≫ Http4s Version 1.0.0 Update milestone3
Typelevel ≫ Http4s Version 1.0.0 Update milestone4
Typelevel ≫ Http4s Version 1.0.0 Update milestone5
Typelevel ≫ Http4s Version 1.0.0 Update milestone6
Typelevel ≫ Http4s Version 1.0.0 Update milestone7
Typelevel ≫ Http4s Version 1.0.0 Update milestone8
Typelevel ≫ Http4s Version 1.0.0 Update milestone9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.4% 0.689
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.8 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
security-advisories@github.com 5.8 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9
Patch
Third Party Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-6h7w-fc84-x7p6
Patch
Third Party Advisory
https://mvnrepository.com/artifact/org.http4s/http4s-core
Third Party Advisory