5.3

CVE-2023-22465

Exploit

Http4s has fatal error parsing User-Agent and Server headers

Http4s is a Scala interface for HTTP services. Starting with version 0.1.0 and prior to versions 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38, the `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs.  In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38. As a workaround, use the weakly typed header interface.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Typelevel ≫ Http4s Version >= 0.1.0 < 0.21.34
Typelevel ≫ Http4s Version >= 0.22.0 < 0.22.15
Typelevel ≫ Http4s Version >= 0.23.0 < 0.23.17
Typelevel ≫ Http4s Version 1.0.0 Update milestone1
Typelevel ≫ Http4s Version 1.0.0 Update milestone10
Typelevel ≫ Http4s Version 1.0.0 Update milestone11
Typelevel ≫ Http4s Version 1.0.0 Update milestone12
Typelevel ≫ Http4s Version 1.0.0 Update milestone13
Typelevel ≫ Http4s Version 1.0.0 Update milestone14
Typelevel ≫ Http4s Version 1.0.0 Update milestone15
Typelevel ≫ Http4s Version 1.0.0 Update milestone16
Typelevel ≫ Http4s Version 1.0.0 Update milestone17
Typelevel ≫ Http4s Version 1.0.0 Update milestone18
Typelevel ≫ Http4s Version 1.0.0 Update milestone19
Typelevel ≫ Http4s Version 1.0.0 Update milestone2
Typelevel ≫ Http4s Version 1.0.0 Update milestone20
Typelevel ≫ Http4s Version 1.0.0 Update milestone21
Typelevel ≫ Http4s Version 1.0.0 Update milestone22
Typelevel ≫ Http4s Version 1.0.0 Update milestone23
Typelevel ≫ Http4s Version 1.0.0 Update milestone24
Typelevel ≫ Http4s Version 1.0.0 Update milestone25
Typelevel ≫ Http4s Version 1.0.0 Update milestone26
Typelevel ≫ Http4s Version 1.0.0 Update milestone27
Typelevel ≫ Http4s Version 1.0.0 Update milestone28
Typelevel ≫ Http4s Version 1.0.0 Update milestone29
Typelevel ≫ Http4s Version 1.0.0 Update milestone3
Typelevel ≫ Http4s Version 1.0.0 Update milestone30
Typelevel ≫ Http4s Version 1.0.0 Update milestone31
Typelevel ≫ Http4s Version 1.0.0 Update milestone32
Typelevel ≫ Http4s Version 1.0.0 Update milestone33
Typelevel ≫ Http4s Version 1.0.0 Update milestone34
Typelevel ≫ Http4s Version 1.0.0 Update milestone35
Typelevel ≫ Http4s Version 1.0.0 Update milestone36
Typelevel ≫ Http4s Version 1.0.0 Update milestone37
Typelevel ≫ Http4s Version 1.0.0 Update milestone4
Typelevel ≫ Http4s Version 1.0.0 Update milestone5
Typelevel ≫ Http4s Version 1.0.0 Update milestone6
Typelevel ≫ Http4s Version 1.0.0 Update milestone7
Typelevel ≫ Http4s Version 1.0.0 Update milestone8
Typelevel ≫ Http4s Version 1.0.0 Update milestone9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.85% 0.532
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://github.com/http4s/http4s/security/advisories/GHSA-54w6-vxfh-fw7f
Third Party Advisory
Exploit
Mitigation