GHSA-q89x-f52w-6hj2 CVE-2017-18587 RUSTSEC-2017-0002
Headers containing newline characters can split messages in hyper
- Severity
- 5.3 / 10
- Medium · CVSS 3.0
- Exploit chance (EPSS)
- 1.03%
- Chance of exploitation in the next 30 days. Higher than 63.78% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
- Fix
0.10.2- Upgrade hyper to this version or later
Description
Serializing of headers to the socket did not filter the values for newline bytes (\r or \n), which allowed for header values to split a request or response. People would not likely include newlines in the headers in their own applications, so the way for most people to exploit this is if an application constructs headers based on unsanitized user input.
This issue was fixed by replacing all newline characters with a space during serialization of a header value.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| hyper | >= 0.10.0, < 0.10.2 |
0.10.2 |
| hyper | < 0.9.18 |
0.9.18 |
| hyper | >= 0.0.0-0, < 0.9.18>= 0.10.0, < 0.10.2 |
0.9.180.10.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
hyper crates.io → 0.10.2
- cargo
cargo update -p hyper --precise 0.10.2
Severity breakdown
CVSS 3.0 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How to prevent it
- Implementation: Avoid using CRLF as a special sequence.
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-f67m-9j94-qv9j Parser creates invalid uninitialized value | High | Also affects hyper |
| GHSA-f3pg-qwvg-p99c Lenient Parsing of Content-Length Header When Prefixed with Plus Sign | Low | Also affects hyper |
| GHSA-5h46-h7hh-c6x9 Integer Overflow in Chunked Transfer-Encoding | Medium | Also affects hyper |
| GHSA-6hfq-h8hq-87mf HTTP Request Smuggling in hyper | Medium | Also affects hyper |
| GHSA-h3qr-rq2j-74w4 HTTP Request Smuggling in hyper | Critical | Also affects hyper |
| GHSA-9xjr-m6f3-v5wm HTTPS MitM vulnerability due to lack of hostname verification | Medium | Also affects hyper |
| GHSA-h4x7-gw46-3wm6 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers | Medium | Same weakness, CWE-93 |
| GHSA-j9f9-w8pj-32f8 Spring Framework Server Sent Event stream corruption while rendering fragments | Critical | Same weakness, CWE-93 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor