CVE-2021-39185

Опубликовано: 01 сент. 2021

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original CORS implementation and CORSConfig are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

Ссылки

https://github.com/http4s/http4s/releases/tag/v0.23.2
Third Party Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6
Patch
Third Party Advisory
https://github.com/http4s/http4s/releases/tag/v0.23.2
Third Party Advisory
https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*

Версия до 0.21.26 (включая)

cpe:2.3:a:typelevel:http4s:*:*:*:*:*:*:*:*

Версия от 0.22.0 (включая) до 0.22.2 (включая)

cpe:2.3:a:typelevel:http4s:0.23.0:*:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:0.23.1:*:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone1:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone10:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone11:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone12:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone13:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone14:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone15:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone16:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone17:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone18:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone19:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone2:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone20:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone21:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone22:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone23:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone24:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone3:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone4:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone5:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone6:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone7:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone8:*:*:*:*:*:*

cpe:2.3:a:typelevel:http4s:1.0.0:milestone9:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.00169

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-346

Связанные уязвимости

GHSA-52cf-226f-rhr6