GitHub Advisoryadvisory · Maven

GHSA-xrr9-rh8p-433v Request smuggling is possible when both chunked TE and content length specified

LOW Published 2020-01-27 Modified 2021-01-08 Official page ↗

Aliases: CVE-2020-5207
Ecosystem: Maven
Packages: io.ktor:ktor-client-cio, io.ktor:ktor-server-cio
Severity: Low
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses: CWE-444
Reviewed: 2020-01-27

Affected packages

• Maven io.ktor:ktor-client-cio: < 1.3.0 → fixed in 1.3.0 • Maven io.ktor:ktor-server-cio: < 1.3.0 → fixed in 1.3.0

Description

Impact Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator. Patches https://github.com/ktorio/ktor/pull/1547 Workarounds None except migrating to a better proxy. References https://portswigger.net/web-security/request-smuggling https://tools.ietf.org/html/rfc7230#section-9.5

Related

Alias · CVE (1)

CVE-2020-5207 In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding… vulnerability

Weakness · CWE (1)

CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References