Описание
A flaw was found in SwiftNIO HTTP/2. This vulnerability allows a remote attacker to perform HTTP request smuggling or response splitting. The issue stems from insufficient validation of incoming HTTP/2 HEADERS frames, which are parts of an HTTP/2 request. This allows special control characters, such as carriage return (CR) and line feed (LF), to reach an HTTP/1.1 backend, potentially bypassing security controls and enabling malicious manipulation of web requests or responses.
Отчет
This vulnerability in SwiftNIO HTTP/2, which could lead to HTTP request smuggling or response splitting due to incomplete header validation, does not affect Red Hat products. Red Hat's analysis indicates that the affected component is not present or not configured in a vulnerable manner within supported offerings.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | swift-lang | Not affected |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
swift-nio-http2: Missing CR/LF/NUL validation in header values
5.3 Medium
CVSS3