CVE-2020-35884

Опубликовано: 31 дек. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 6.4

EPSS Низкий

Описание

An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header.

Ссылки

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3JDNRE5RXJOWZZZF5QSCG4GUCSLTHF2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO6SRTCEPEYO2OX647I3H5XUWLFDRDWL/
https://rustsec.org/advisories/RUSTSEC-2020-0031.html
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3JDNRE5RXJOWZZZF5QSCG4GUCSLTHF2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO6SRTCEPEYO2OX647I3H5XUWLFDRDWL/
https://rustsec.org/advisories/RUSTSEC-2020-0031.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tiny-http_project:tiny-http:*:*:*:*:*:rust:*:*

Версия до 0.7.0 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

EPSS

Процентиль: 47%

0.00239

Низкий

6.5 Medium

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-444

Связанные уязвимости

GHSA-7v2r-wxmg-mgvc